MAL-2026-13291

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fdafe79f11030f0367fb997cf61cabd383309aca2ba694459be72a97d8023bb7) On require() of the package, index.js loads _helpers.js which immediately runs an init() routine that fetches a platform-specific binary over HTTPS from a set of hosts reassembled at runtime via string split-and-join: oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, and sdk.dl.wel1.ru, with a DNS TXT chunked-base64 fallback for host discovery. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmod'd 0755, and spawned detached via /bin/sh -c "<path> &" or cmd /c start. No hash or signature check is performed. A sibling file lib/telemetry.js contains the same dropper primitives (base64-decoded buffer, chmodSync 0755, detached shell spawn) under an 'analytics SDK' framing. Hostnames are reconstructed from arrays such as ["oob-worker.cf101-adf.worker","s.","de","v"].join("") and ['sdk.dl.','wel','1.ru'].join("") to evade static scanners. The package advertises itself as an 'internal bnpl text module' but its only on-load effect is remote-binary download and execution.