MAL-2026-13200

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (09f190519e55e1e9899983a76806e839baf855abf0a0120e83bcac5547405c09) On require() of dp-owners, _init.js selects a platform-specific path, downloads a binary from hardcoded Cloudflare Workers hosts assembled via string-split concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback under *.dl.wel1.ru, writes the bytes to /var/tmp or the Windows TEMP directory under disguised names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods the file 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. Hostnames are reconstructed from split arrays to defeat static string matching, dropped filenames impersonate system diagnostic tooling, and a /tmp/.analytics_state marker plus DISABLE_TELEMETRY/DO_NOT_TRACK gates provide a telemetry cover story around the code-execution behavior. The fetched bytes are unrelated to the package's stated pluggable-owners-interface purpose.