MAL-2026-13311

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3) On require() of dolyame-boxy-fonts, index.js unconditionally loads./_loader.js, which reconstructs C2 hostnames from split-string arrays (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and a DNS-TXT fallback channel under *.dl.wel1.ru (chunk-count via c.<domain>, base64 chunks via N.<domain> retrieved through dns.resolveTxt). _loader.js downloads a platform-specific binary, writes it to /tmp or %TEMP% under a hidden/decoy name (.cache_<rand> or dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. The fetched bytes are opaque, unpinned, and not hash-verified, and the destination hosts are anonymous Cloudflare Workers subdomains assembled at runtime to defeat static grep. A sibling module lib/telemetry.js ships in the tarball with the same dropper primitives (require('child_' + 'process') string-split, fs['chmod' + 'Sync'], cp.spawn('/bin/sh', ['-c', filePath + ' &'])), providing an alternate execution path. Installing or requiring this package causes attacker-controlled code to execute on the installer's machine.