MAL-2026-13525

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f4eccfe477123e2d048f10c141165dec00f0ce2bfe28b7b9611a189fc63f0384) On require('bigops-security'), index.js loads _bridge.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf10{0..3}-*.workers.dev) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru subdomains. Destination hostnames are reconstructed at runtime from split string arrays (e.g. ['sdk','.dl.','wel1.','ru'].join('')) rather than appearing as plain literals. The fetched bytes are written to /tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmod 755'd, and detach-spawned via spawn('/bin/sh',...) or spawn('cmd',...) at _bridge.js:121-127. Cover-story identifiers ("analytics", "telemetry", "CDN", "Respect opt-out") frame the code as benign while the actual behavior is fetch-and-execute of an opaque binary from author-controlled infrastructure. No native-build purpose is present in the tarball; the package advertises itself as a security module.