MAL-2026-13189

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e) On require of the package's main entry, `_compat.js` reconstructs Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev) and a DNS-TXT fallback discovery host (sdk.dl.wel1.ru) from split string arrays joined at runtime, downloads a platform-specific binary via https.get, writes it under /tmp or %TEMP% with disguised names (dotnet_diag_<rand>.exe,.cache_<rand>), chmods 0o755, and spawns it detached via `/bin/sh -c` or `cmd`. Staging paths and destinations are runtime-assembled to evade literal string matching, and the payload uses cover-story naming resembling system diagnostics. The package presents itself as a UI table toolkit, which has no need for native binary downloads or subprocess execution.