MAL-2026-13531

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f) On require() of the package, _polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts (oob-worker.cf10x-*.workers.dev) with a DNS TXT-record chunked-base64 fallback channel via *.dl.wel1.ru, writes the binary to a hidden path (/tmp/.cache_<hex> on Unix, %TEMP%\dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached through /bin/sh or cmd.exe. The C2 hostnames are reconstructed at runtime by joining split string fragments to evade static detection, and the DNS-TXT fallback provides a covert transport when HTTPS egress is blocked. The behavior is framed as 'telemetry/analytics'. The fetched bytes are opaque, unversioned, and unpinned by hash, and originate from non-publisher infrastructure.