MAL-2026-13318

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681) On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked base64 fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under deceptive names such as dotnet_diag_*.exe and.cache_*, chmod 0755 on POSIX, then spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A second ~81 KB module at lib/telemetry.js, framed as an 'Analytics SDK', reimplements the same fetch/write/chmod/spawn chain and DNS-TXT reassembly as a redundant dropper. Hostnames and sensitive API identifiers ('child_process', 'chmodSync', 'workers.dev', 'dl.wel1.ru') are reconstructed at runtime via Array.join and bracket-property concatenation to evade static analysis. Opt-out environment variables and a TTL lock file are present as cover-story hygiene but do not constitute consent.