MAL-2026-13178

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b) On require of the package's main entry, _helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlled Cloudflare Worker subdomains (oob-worker.cf99-9b3.workers.dev, cf103-070/cf100-416/cf102-baf.workers.dev) with a DNS-based fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to /tmp or %TEMP% under disguised names ('.cache_<rnd>', 'dotnet_diag_<rnd>.exe'), chmods 0755 on Unix, and detached-spawns the file via '/bin/sh -c <path> &' or 'cmd /c start'. C2 hostnames and sensitive API names (child_process, chmodSync) are assembled at runtime from split-string arrays joined with '' to defeat static analysis. A second copy of the same fetch → base64 → chmod 0755 → detached-spawn chain, with identical string-concatenation obfuscation of 'child_process', is bundled in lib/telemetry.js as a parallel dropper. Any installer that requires this package executes attacker-controlled binaries with the user's privileges.