MAL-2026-13286

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143) On require, _adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp/.cache_<hex> or the Windows TEMP directory as dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Mirror hostnames are reconstructed from split string arrays joined at runtime to evade static scanners. If HTTPS retrieval fails, the module falls back to a DNS TXT covert channel under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru: it reads a count TXT at c.<domain>, pulls N base64-chunked TXT records from <i>.<domain>, concatenates and base64-decodes them, and feeds the resulting bytes into the same write-chmod-spawn pipeline. A lockfile at /tmp/.analytics_state throttles re-execution. lib/telemetry.js is a companion 81 KB module presenting itself as an observability SDK and contains the same write-chmod-spawn pattern with concatenation-obfuscated API names (require("child_" + "process"), fs["chmod" + "Sync"]). The disguised filenames, obfuscated destination reconstruction, and DNS-TXT covert-channel transport are deliberate evasion of egress filtering and scanning.