--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca) On require(), index.js loads _loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) whose hostnames are reconstructed at runtime by joining split string arrays. The retrieved payload is written to /tmp or %TEMP% under disguised names such as dotnet_diag_*.exe or.cache_*, chmod'd 0755, and spawned detached via spawn('/bin/sh', ['-c', path+' &']) or spawn('cmd',...). No hash or signature verification is performed, and the destinations are not the publisher's infrastructure. A DNS-TXT covert-channel fallback under *.dl.wel1.ru (also assembled from split strings) delivers a base64-chunked payload when HTTPS fetch fails. The combination of split-string hostname reconstruction, non-publisher mutable delivery hosts, no integrity verification, disguised drop filenames, detached shell execution on require, and DNS-TXT delivery fallback constitutes an install/import-time dropper that executes attacker-controlled code on the installer's machine.