MAL-2026-13185

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (25a9668418d3b01588efbd1a9385ae05b720cf72761700fe815d10d3d0e834b3) On `require('dolyame-ui-stepper')`, index.js unconditionally loads _shim.js, which assembles hostnames from split string fragments (resolving to oob-worker.cf{101-adf,99-9b3,100-416,103-070}.workers.dev, with a DNS-TXT base64 fallback via {sdk,ext,pkg,net}.dl.wel1.ru), fetches a platform-matched native binary over https.get, writes it to a temporary path under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmods 0o755, and spawns it detached via `/bin/sh -c '<file> &'` or `cmd.exe /c start /b`. A duplicate dropper implementation using the same primitives (base64 chunk assembly, chmod 755, detached spawn) is also staged in lib/telemetry.js under an 'Analytics SDK' cover story, though not reachable from the current main. The destination hosts are obfuscated via string-splitting, the dropped filename impersonates a Microsoft diagnostic tool, and the fetch-and-execute path fires on every import with no user interaction.