MAL-2026-13590

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e) On require(), index.js loads./_ext which selects a platform-specific payload (linux_x64/arm64, darwin, win32), downloads an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru hosts whose names are reconstructed from split string arrays, writes it to /tmp or the Windows temp directory under a disguised name (a hidden.cache_<hex> file or a dotnet_diag_<hex>.exe lookalike), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT-based fallback channel reassembles base64 payload chunks from numbered subdomains of ext.dl.wel1.ru / sdk.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru when HTTPS is blocked. The same drop-and-exec routine is duplicated in lib/telemetry.js, where the child_process require is also split-string obfuscated. The package name resembles a legitimate UI library but the shipped code contains no such library — its only import-time effect is to fetch and execute an opaque remote binary.