Search: at.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287) On require of the package, index.js loads _platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation (oob-worker.*.workers.dev variants and sdk/ext/pkg/net.dl.wel1.ru), fetches a platform-specific binary over HTTPS with a DNS-TXT base64 fallback channel, writes it to /var/tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Cover-story identifiers such as analytics_state and a DISABLE_TELEMETRY opt-out are used to frame the behavior as telemetry. The package name impersonates a Russian BNPL partner integration, and none of the shipped code implements that stated purpose. ## Source: ghsa-malware (d48aace5fa5e8401a0a067c1eef992fb95425f9aca20add86d6c0214a530b412) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231) index.js unconditionally requires./_loader on load. _loader.js selects a platform-specific payload path (linux_x64, linux_arm64, darwin, win32) and downloads a binary from Cloudflare Workers hostnames assembled at runtime by joining split string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", path + " &"]) or spawn("cmd.exe", ["/c", "start", "/b", path]). A sibling lib/telemetry.js wraps the same primitives (require("child_" + "process"), fs["chmod" + "Sync"], base64 chunk decode, spawn of /bin/sh and cmd.exe) inside Sentry-mimicking scaffolding as an alternate loader. No hash, signature, or publisher verification is performed on the fetched payload. The typosquat-style package name, split-string hostname reassembly, cover-story filenames (.cache_, dotnet_diag_), and detached/unref'd execution are consistent with a purpose-built import-time dropper. ## Source: ghsa-malware (9798a6a34ba04688210f68cbf4582d669ef1a91abeeb44a27ffd05c73921240c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698) index.js unconditionally requires./_bridge on load. _bridge.js selects a per-platform payload (linux x64/arm64, darwin, win32), fetches a native binary over HTTPS from a hardcoded list of Cloudflare *.workers.dev endpoints (assembled at runtime by joining split string arrays such as ["oob-worker.cf101-adf.work","ers",".de","v"]), writes it to /tmp/.cache_<uid> or %TEMP%/dotnet_diag_<uid>.exe under names that impersonate benign artifacts, chmods 0755 on POSIX via fs["chmod"+"Sync"], and spawns it detached through /bin/sh -c on POSIX or cmd.exe /c start /b on Windows. A DNS TXT covert-channel fallback resolves alternate payload sources under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, with the discovery domains also reconstructed from split arrays. lib/telemetry.js ships a second parallel dropper implementation labelled as an "Analytics SDK" (base64 payload assembly, chmodSync 0755, /bin/sh -c spawn) that is not reached from the current index.js but is packaged in the tarball. The advertised purpose (a BNPL banner abstraction) has no relationship to fetching and executing platform-specific native executables, and the destinations are not publisher-owned. ## Source: ghsa-malware (136bb556f5d69b483536f852deeebae245dcd87809dd2dd7e39f1909acabefae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (31565660321da87adf5d579f4608cd6059c88afd2c95a04eb7223031881572f7) The package's top-level index.js unconditionally requires./_platform on load. _platform.js reconstructs a set of mirror hostnames via string-split concatenation (oob-worker.cf101-adf.workers.dev family) and a DNS-TXT discovery fallback under *.dl.wel1.ru, selects a per-architecture endpoint from an internal _BIN_MAP, fetches an opaque binary over HTTPS, writes it to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe under a cover filename, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. lib/telemetry.js ships the same fetch-decode-write-chmod-spawn primitive framed as an 'analytics SDK', with require("child_"+"process"), Buffer.from(chunks,"base64") decoding, fs["chmod"+"Sync"](...,0o755), and cp.spawn("/bin/sh",["-c",filePath+" &"]). Hostnames, discovery domains, and the child_process module name are assembled from split fragments to evade static analysis. The fetched payload does not match the package's stated purpose (a BNPL mobile SDK), the destinations are author-controlled and obfuscated, and execution fires at require-time with only TTL cache and opt-out env-var guards. ## Source: ghsa-malware (396c85bd51889c7c46eeeab08db2ab12eae0ab199a620dae44def63226897189) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437) On require, index.js loads _init.js which reconstructs hostnames from split-string arrays (e.g. ['oob-worker.cf102','-baf.workers.','dev'].join('') and ['sdk.dl.','wel1.ru'].join('')) to build URLs against four Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific binary is downloaded via https.get, written to /tmp or %TEMP% under disguised names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmodded 0755, and launched detached via spawn('/bin/sh', ['-c', path+' &']) or spawn('cmd',...). The fetched payload is unverified, comes from mutable non-publisher hosts, and executes on module load rather than through any documented API of the package. ## Source: ghsa-malware (7cd7386bf67dcd89be60f275d29aa374bf07fa12a56f1ff56bef400c7b2ddf17) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c) On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts (with a DNS TXT fallback via sdk.dl.wel1.ru), writes it to /var/tmp or %TEMP% under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed from array-joined string fragments (e.g. ['oob-worker','.cf10','1-adf.w','ork','ers.d','ev'].join('')) and require is split as require('child_'+'process') to evade static scanners. Execution is gated by a lockfile cooldown to run once per host. The package name impersonates the Dolyame BNPL brand; the shipped code is a generic remote-binary dropper unrelated to any BNPL functionality, granting the operator of the Workers hosts arbitrary code execution on any machine that installs or imports this package. ## Source: ghsa-malware (77a936690ebd1b36e35495e4a0b18b8913b0a8ff9c45348179943b52974eeb76) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae) The package presents itself as a UI dropdown library but on require executes _init.js, which selects a platform-specific asset (linux/darwin/win32), fetches an opaque binary over HTTPS from string-fragmented `*.workers.dev` hosts (assembled via `.join('')` to hide the hostname from static scanners) with a DNS-TXT chunked-base64 fallback to `*.dl.wel1.ru`, writes the payload to /var/tmp or %TEMP% under a disguised name (`dotnet_diag_<hex>.exe` on Windows, `.cache_<hex>` on Unix), chmods it 0755, and spawns it detached via `/bin/sh -c "<file> &"` or `cmd.exe /c start /b`. The `require("child_"+"process")` split, the fragmented CDN host arrays, the.NET-diagnostics filename masquerade, and an `analytics_state` marker file provide cover-story framing. There is no pinning, hash verification, publisher-matched origin, or relation to a UI dropdown component. Installing or importing the package results in arbitrary attacker-controlled code executing on the installer's host. ## Source: ghsa-malware (5aa96551428ffa96321135f6a2df75bfddc6d1a28627a94dc3d689940e13e377) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061) The package's main entry (index.js) unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from a rotating list of Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) whose hostnames are assembled via array-join string splitting to evade static analysis, with a DNS-TXT chunked fallback across sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path under a disguised name ('dotnet_diag_<tag>.exe' on Windows or '.cache_<tag>' on POSIX), chmod 0755, and spawned detached via cmd.exe /c start /b or /bin/sh -c "fp &". There is no hash or signature verification of the downloaded payload; the source hosts are attacker-controlled infrastructure unrelated to the package's stated Vite-plugin purpose. Execution is suppressed by DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables and cached via a marker file with a ~21329s TTL, framing the behavior as telemetry while dropping and running an opaque binary. Any consumer that requires or imports this package triggers full-host code execution under attacker control. ## Source: ghsa-malware (8c85582964f88194107914cd82214c07879ac0ae310f6fd7af6c885b30145a71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c7a6f956dc3e60442172279367aeb7cbfb758a853f844c53b3ff22a972f0bac5) On require('beaver-ui-popover-card'), _support.js downloads a platform-specific binary from Cloudflare Workers endpoints whose hostnames are assembled at runtime from split string fragments (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback resolver chain across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a temp path under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0o755, and spawned detached via /bin/sh -c or cmd. No signature or hash verification is performed. A cover 'analytics_state' TTL file caches the drop for ~6 hours to run once per window. A second dropper of the same shape is bundled in lib/telemetry.js (~81KB) wrapped in a 'telemetry SDK' cover story, using runtime string concatenation to hide API names ('chmod'+'Sync', 'child_'+'process') and base64-decoded chunk reassembly. Hostname obfuscation, fetch destinations unrelated to the package publisher, disguised filenames, DNS covert-channel fallback, and detached execution together are unambiguous dropper behavior triggered on any require() of the package. ## Source: ghsa-malware (8576ef2b39edb805a47435820b132a90d89fc93902e97cc279a334cc04d5fa8d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bbb4bab7b1c75e94cd3411aa312a1313e3d5a84bed77943b10f8c969b751cb23) On require() of the package's main entry, index.js loads _loader.js which selects a per-platform URL, downloads an opaque native binary from one of three Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The bytes are written to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. Hostnames are assembled from split string arrays (e.g. ["oob-worker.cf99-9b3.wor","kers.","dev"].join("")) to evade substring scans, and file names (analytics_state, dotnet_diag) masquerade as diagnostics artifacts. A telemetry-styled opt-out gate (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) frames the download-and-execute as consented telemetry, but the default path is unconditional remote code execution. No hash or signature verification is performed; the URL is mutable and anonymous. The package name resembles a UI select component but its only observable behavior on import is the dropper. ## Source: ghsa-malware (9c3519c1c22bb4eab75836d741089a70981c2909eea8323132d4424fb338f929) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf) On require() of devplatform-table, index.js loads./_compat which selects a platform-specific payload path, downloads an executable from string-concatenation-obfuscated Cloudflare Workers hosts (reconstructed from fragments such as ["oob-worker.cf103-070.workers.d","ev"].join("")) with a DNS-TXT fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Sensitive API identifiers including 'child_process' and 'chmodSync' are also reassembled at runtime from fragments to evade static analysis. The fetched binary is unpinned, unverified, and comes from anonymous worker hosts unrelated to any package publisher domain, giving whoever controls those hosts arbitrary code execution on any machine that installs or imports this package. ## Source: ghsa-malware (23fce942e6ee47af9c4b4307a39ae0610e74959875c3a7cd1ecea82c97bc46a7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b62336df8b8ee0e1bd3939f4515a4b25dd6741773f30344cd3a0d065d16358fb) The package advertises itself as a UI subheader component, but index.js requires./_support on load and _support.js downloads a platform-specific binary from string-concatenated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf102-baf, cf100-416, cf103-070) with a DNS TXT-record fallback that reassembles base64 chunks from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_XXXX on Unix or %TEMP%/dotnet_diag_XXXX.exe on Windows, chmodded to 0755, and spawned detached via /bin/sh -c or cmd. Destination hostnames are assembled at runtime through array-join concatenation to defeat static analysis, dropped filenames masquerade as.NET diagnostics or hidden cache files, and the behavior is gated behind DISABLE_TELEMETRY/ANALYTICS_OPT_OUT environment variables and a.analytics_state TTL stamp file to present a telemetry cover story. A UI component library has no legitimate reason to fetch and execute an opaque native binary from anonymous Cloudflare Workers hosts at require time. ## Source: ghsa-malware (77c555ecdc70942121beda0c89e556c311f04bc6bc986fdc364ddbb6b07e7f09) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb) On require('beaver-ui-pagination'), index.js loads _init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback via *.dl.wel1.ru subdomains. The fetched binary is written to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> on POSIX, dotnet_diag_<rnd>.exe on Windows), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime from array.join to evade static inspection, and env-var opt-outs (DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK) plus an 'analytics_state' marker file frame the behavior as telemetry despite the fetch-and-execute flow. A sibling lib/telemetry.js not currently reachable from index.js ships a second copy of the dropper primitives (dynamic require('child_'+'process'), base64-chunked buffer, chmodSync 0755, /bin/sh spawn of a filePath). ## Source: ghsa-malware (123cbe3def4ec949ca2a0fb1332af1a517ccd370290ba923f0f474a54761f4bf) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a9aeae07ad8c21acdd73d30a24723d30ef468f03a3412e21ea4bf726f27c2f12) The package is advertised as a React UI filter component but on require of index.js loads _adapter.js, which assembles remote hostnames from split string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback under dl.wel1.ru, downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via spawn("/bin/sh",["-c",fp+" &"]) or spawn("cmd",...). A stale-cache flag file is named analytics_state to appear benign, and a DISABLE_TELEMETRY environment variable suppresses the drop, reducing detection during review. The remote hosts are not the publisher's infrastructure, no version pinning or hash verification is performed, and the fetched bytes are executed on the installer's machine. ## Source: ghsa-malware (253621455f9f4ce0a63a61aacd8409adb19d73b818ffbe023e729aaf6cce2daa) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41) On require() of devplatform-spa-plugin-s3-router, index.js loads _helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflare Workers hostnames (oob-worker.cf10-0-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) via string-splitting and.join("") to hide them from static scans, with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (sdk, ext, pkg, net) that reconstructs a base64-encoded binary from numbered subdomain TXT records. The retrieved binary is written to /tmp or the Windows temp directory under a disguised name mimicking Microsoft dotnet diagnostics (dotnet_diag_<hex>.exe or.cache_<hex>), chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start. A.analytics_state file rate-limits re-execution. A sibling lib/telemetry.js contains the same dropper primitives (HTTPS fetch, DNS service discovery, chmodSync to 0755, cp.spawn of /bin/sh -c on the dropped file) though it is not currently reached from index.js. The package advertises itself as an SPA S3 router plugin and has no legitimate reason to fetch and execute a native binary at import time. ## Source: ghsa-malware (5a5b51f0b5bcc60ce843f2828af3152cb384ff04a096c62c8acc5fcf86775a08) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d) On require()/import of the package, index.js unconditionally loads _helpers.js which fetches a platform-specific binary from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with DNS-TXT-based fallback via *.dl.wel1.ru subdomains. Host names and sensitive API identifiers (child_process, chmodSync) are assembled at runtime from split string fragments via.join("") to evade static detection. The fetched opaque binary is written to /tmp or %TEMP% under cover names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe with no hash or signature verification. A cover-story telemetry framing (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks,.analytics_state marker file) accompanies the dropper. lib/telemetry.js contains a second implementation of the same fetch-write-chmod-spawn pattern. The name resembles a legitimate UI component package but the code has no UI functionality. ## Source: ghsa-malware (1c7e152f4dd2321e9c855b7658a7eca2e365c9260f0a7d962d0bd7e6359db6a7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6) On require('beaver-ui-object-card'), index.js loads _ext.js which selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors, with a DNS TXT chunked-base64 fallback resolver, then writes the binary to /var/tmp or %TEMP% under deceptive names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hosts and resolver domains are reassembled at runtime from split-string arrays (e.g. ["oob-worker.cf100-416.worker","s.de","v"].join("") and ['sdk.dl','.wel','1.r','u'].join("")) to defeat static analysis. A cover-story surrounds the dropper: an 'analytics_state' lock file, a DISABLE_TELEMETRY env gate that does not actually disable execution, a node-fetch/2.6 User-Agent, and an unreachable lib/telemetry.js presenting an 'Analytics SDK' facade. The delivered binary is attacker-controlled, unpinned, unsigned, mismatched to any documented package purpose, and executed detached on the installer's host at import time. ## Source: ghsa-malware (e5933354eabc23202d7e993aa70f3cb868291f3c49bc4a83bf4576718191c852) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77) On require('beaver-ui-list'), index.js loads _ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked fallback to *.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. Host and domain literals are assembled at runtime from split-string arrays joined with.join("") to defeat static inspection, and a.analytics_state marker file plus a check of DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables provide a telemetry cover story. The package advertises itself as a UI component library; the payload delivery and execution have no relationship to that purpose and grant arbitrary code execution on the installer's host on module load. ## Source: ghsa-malware (f5e521e22029d0d16625f9ea6f10948e11b7dbc61f9f278b4db8a55c07d8d4cf) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b) index.js unconditionally requires _runtime.js, whose top-level start() function selects a platform-specific asset path, fetches an opaque binary from string-array-obfuscated hostnames reconstructed at runtime (oob-worker.cf1-03-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a hidden file under /tmp or %TEMP% with a random suffix (e.g..cache_<hex> or dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. A fallback covert channel resolves c.<domain> TXT records for a chunk count, then fetches <i>.<domain> TXT records from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-decodes the concatenation into the executable payload, bypassing HTTP egress filtering. No hash or signature verification is performed and the destination is not the publisher. A sibling file lib/telemetry.js under an 'analytics-sdk' cover story ships the same download→base64-decode→chmod 0755→sh -c file & chain as a staged alternate payload. Requiring or installing this package causes attacker-controlled native code to run on the installer's machine. ## Source: ghsa-malware (a5faa7e2f12c9eabdb7879bf9d4b2aaf2310f04df1c66c3de3dadaad22ad7358) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db) On require() of the package main, _loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to /tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel: it queries TXT records under *.dl.wel1.ru subdomains (sdk/ext/pkg/net.dl.wel1.ru), concatenates base64 chunks across sequentially-numbered records, decodes, writes, and executes the payload. No hash or signature verification is performed. C2 hostnames are assembled at runtime via array.join("") splits to evade static string matching, and the code is framed with cover-story names (analytics_state, dotnet_diag_, DISABLE_TELEMETRY opt-out) unrelated to the package's declared Storybook-addon purpose. Fetched destinations are unrelated to the publisher's stated purpose, and the payload is attacker-controlled arbitrary code executed on the installer's machine at package load time. ## Source: ghsa-malware (16b18111e619307c26865a435d893b1e8947711075425743f4f1d34820a1ad77) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.