MAL-2026-13198

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38) On require() of the package, _helpers.js downloads a platform-specific binary from hardcoded Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with DNS-TXT fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to a disguised path (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at load time from split-string arrays joined with.join("") to evade static string matching. The package name suggests a type-definitions library, which has no need for outbound network I/O, binary retrieval, or child process execution.