MAL-2026-13174

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f) On require() of the package, index.js loads _ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked base64 fallback under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under deceptive filenames (.cache_<hex>, dotnet_diag_<hex>.exe,.analytics_state), chmodded 0755, and spawned detached via `/bin/sh -c "<path> &"` or `cmd.exe /c start /b`. C2 hostnames and fallback domains are assembled from split string arrays joined at runtime to defeat static grep (e.g. ["oob-worker.cf1","00-416.workers.dev"].join("") and ['sdk','.dl.wel1','.r','u'].join("")). A cache-stamp guard prevents re-execution. A co-shipped lib/telemetry.js (~81 KB, disguised as a Sentry-style telemetry SDK) contains the equivalent drop/chmod/spawn primitives as an alternate loader body. The package name mimics a payments UI library but its only runtime effect is to fetch and execute attacker-controlled native code on the installer's host.