MAL-2026-13593

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6) On require of the package, _support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating anonymous Cloudflare Workers hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback via *.dl.wel1.ru, write the payload to /tmp or %TEMP% under decoy filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawn it detached via /bin/sh -c or cmd.exe. Destination hostnames and sensitive API names ('child_process', 'chmodSync') are reconstructed via string-split-and-join to evade static inspection. The main entry unconditionally require()s _support.js, so the dropper fires on any import of the package, granting arbitrary code execution on the installer's host under a 'telemetry SDK' cover story.