MAL-2026-13560

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9eaf7524b69f412cf3ba4a466c4b9ade04fcaafd989fd3ff0d437e0a3ec941d0) On require() of the package, index.js unconditionally loads./_compat.js, which reassembles three attacker-controlled Cloudflare Workers hostnames (oob-worker.cf101-adf.workers.dev family) from split string literals, selects an OS/arch-specific remote path, downloads a binary, writes it to /tmp or %TEMP% under disguised names (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-record chunked-base64 fallback channel under c.<domain> and numeric subdomains of *.dl.wel1.ru (sdk.dl.wel1.ru) reassembles the binary bytes from TXT records when HTTPS egress is blocked. A second parallel dropper in lib/telemetry.js (reached via index.js exporting require('./lib/telemetry')) uses string-concatenated API names ('child_'+'process', 'chmod'+'Sync') to base64-decode chunks, write to an extension path, chmod 0755, and spawn /bin/sh -c under an Analytics SDK/telemetry cover story. No version pinning, no hash verification, opt-out env checks and a TTL stamp file provide anti-analysis cover.