MAL-2026-13208

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (44896d37931bf7bf16a6061be03cc11eaaf4dbf05780ac9e2ff49a1990986eb7) index.js exports a benign TokenManager facade but silently `require('./_bootstrap')` in a try/catch on load. _bootstrap.js selects a platform-specific asset, downloads an unverified binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT chunked-fetch fallback under *.dl.wel1.ru — writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_,.cache_), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe start /b. Destination hostnames are reconstructed by array.join to evade static string matching. Executes at require() time, so a normal `npm install` + any downstream import runs the fetched binary on the installer host.