Search: at.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8) On require() of this package, index.js loads _helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) whose hostnames are reconstructed at runtime via array.join("") to evade static analysis. The binary is written to /tmp or the Windows Temp directory under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755'd, and spawn-detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A DNS-TXT covert-channel fallback under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) reassembles the payload from base64-encoded TXT records (count record c.<domain>, chunk records i.<domain>) when HTTPS delivery fails, then writes and executes the same way. A lockfile named.analytics_state and dotnet_diag-style filenames provide the cover story. This grants full remote code execution to whoever controls those endpoints on any machine that installs or imports the package. ## Source: ghsa-malware (8eadf4ae9ccb7531ac8f7d7bffccd987c3706ec89be048fb4d5dbe370b53f713) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3) On require() of the package, index.js loads _loader.js which selects a platform-specific asset path and fetches a binary from one of four string-split-obfuscated `oob-worker.cf*.workers.dev` hostnames (with a DNS TXT chunked-base64 fallback via `*.dl.wel1.ru`). The fetched bytes are written to `/var/tmp/.cache_<hex>` (POSIX) or `%TEMP%\dotnet_diag_<hex>.exe` (Windows), chmod 0755'd, and spawned detached via `spawn('/bin/sh',...)` or `spawn('cmd',...)`. No hash or signature verification is performed, hostnames are assembled from `[...].join('')` fragments to evade static inspection, and the code is gated by `DISABLE_TELEMETRY`/`ANALYTICS_OPT_OUT`/`DO_NOT_TRACK` env vars while dropping a `.analytics_state` flag file as a telemetry cover story. Filenames impersonate legitimate.NET/system artifacts (`dotnet_diag_`, dot-prefixed cache). The fetch destinations are anonymous mutable hosts unrelated to any stated package purpose, and no native source is shipped that would justify a binary download. ## Source: ghsa-malware (135914b0e51c8aacf675ddb6fb98037d996d1296a52b77092267cf60e7b05520) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40) On require(), index.js loads _adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and detached-spawns it via child_process.spawn on /bin/sh or cmd. If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel that reassembles base64-encoded chunks from resolver domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reconstructs the binary, and executes it. Hostnames are assembled from split string fragments (e.g. ['oob-worker.','cf100-41','6.workers.dev'].join('')), a.analytics_state stamp file is written, and environment variables named DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK frame the behavior as telemetry despite the payload being an executable binary. Package metadata is placeholder (empty dependencies, no repository/author) and the name impersonates an internal CI/GitLab tool. ## Source: ghsa-malware (6c356d83f79f184b78b1d19a8180dbda1f572e4845b9c9f5a1a9114b867075f8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069) On require() of delivery-ci-storybook, index.js loads _bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) whose hostnames are reconstructed at runtime from split string fragments joined with empty separators. If the HTTP fetch fails, a fallback path reassembles base64 chunks from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The retrieved bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. No hash or signature verification is performed and the destinations are not publisher-controlled infrastructure. The fetched executable is attacker-controlled content executed on the installer's host at package require time. ## Source: ghsa-malware (36e6b52931021e2a924b3e2419dc9d17dd14a86a737cedfe78ed3390995091b4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0) index.js unconditionally requires _bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path (linux_x64, linux_arm64, darwin, win32), fetches an unsigned binary from split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), with a base64-chunked DNS TXT covert channel fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru. The retrieved bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames are constructed by joining string fragments at runtime, dropped filenames use decoy names (dotnet_diag,.cache_,.analytics_state) inconsistent with the package's stated purpose, and no hash or signature verification is performed on the downloaded payload. The destinations are unrelated to any publisher of this package. ## Source: ghsa-malware (75454f2a282eb740a7f1334cb94456d3fdedc39a065c89e3c8fe7f5fa6a3fcfd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174) devplatform-api-v2-resource-mock@35.4.1 is an import-time dropper. The package's main entry (index.js) requires _compat.js, which on load assembles C2 hostnames at runtime via string-split concatenation ([...].join('')) to evade static analysis. It issues an https.get to one of several oob-worker.cf99-*.workers.dev / cf100 / cf101 / cf102 subdomains (with a DNS-TXT chunked fallback to *.dl.wel1.ru), writes the returned bytes to /tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows under cover names impersonating diagnostic tools, chmods the file 0755, and spawns it detached via spawn('/bin/sh', ['-c', <path> + ' &']) or spawn('cmd',...). No hash or signature verification is performed on the fetched payload. A marker file (/tmp/.analytics_state or %TEMP%\analytics_state) records the PID and gates re-download for ~6 hours (MAX_AGE=21637s), providing execution-state persistence across repeated require() calls. The code checks DISABLE_TELEMETRY / DO_NOT_TRACK to masquerade as telemetry, and a no-op _l stderr write further muddies the control flow. Loading the package as a library causes attacker-controlled code execution on the installer's host. ## Source: ghsa-malware (6decf63245ff6c049995ae09f10e2423a031ee335c0ccd8ffb84e483f257fd73) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626) Requiring devplatform-auth-client loads `_bootstrap.js`, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded Cloudflare `workers.dev` subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-based fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes them to /tmp or %TEMP% under decoy names such as `.cache_<hex>` and `dotnet_diag_<hex>.exe`, chmods 0755, and spawns them detached via `/bin/sh -c` or `cmd`. The destination hostnames and dangerous API names are assembled from split-string fragments joined at runtime to evade static scanners. A sibling `lib/telemetry.js` module, presented as an analytics SDK, contains a parallel loader that base64-decodes a payload, dynamically resolves `chmodSync`, and spawns the decoded file. The fetched bytes are unpinned, unverified, and unrelated to any documented publisher. ## Source: ghsa-malware (84dec7cc75aa19ce40a478689c787d0a170d2f8f52aea764f4357e1b83e496a0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea) On require() of the package, index.js loads _bootstrap.js which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS-TXT fallback channel resolving *.dl.wel1.ru hosts (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp or %TEMP% under a randomized name such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe. Hostnames and dangerous API names (child_process, chmodSync) are reconstructed from split-string arrays via Array.join('') to evade static analysis. A secondary module lib/telemetry.js (81 KB) ships the same drop-and-execute primitives (base64 buffer decode, fs.chmodSync 0755, cp.spawn('/bin/sh', ['-c', filePath+' &'])) behind an 'analytics SDK' cover story. The package presents itself as a devplatform CLI lint plugin; the shipped code performs full-host remote code execution on library load. ## Source: ghsa-malware (ea105640a744e8157c32baaf4d5826923dbd99cafbdf4c5652d633368d0c85eb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949) On require('devplatform-data-table'), index.js loads _ext.js inside a swallowed try/catch. _ext.js reconstructs a rotating list of Cloudflare Workers hostnames (oob-worker.cf10{0..3}-*.workers.dev) and a DNS TXT fallback via *.dl.wel1.ru by string-splitting fragments to evade static scanners, downloads a platform-specific binary via https.get, writes it to /tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe with unref(). The download destination has no version pin or hash check and is unrelated to the package's stated data-table purpose; the cover-story filenames (dotnet_diag,.cache,.analytics_state) and split-join hostname construction indicate deliberate concealment. A second file lib/telemetry.js ships the same drop-and-execute primitives (base64 chunk decode, cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached}), fs['chmod'+'Sync']) under an 'Analytics SDK' framing. ## Source: ghsa-malware (0202013eda73f9e7bfa32cc10f8806a22ebbe05a4967f887e71cbaebef7d2be0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc) On require() of devplatform-http-client, index.js loads _vendor.js which unconditionally invokes init(). The routine selects a platform-specific payload path and fetches a native binary from Cloudflare Workers subdomains whose hostnames are reconstructed from split string fragments (e.g. ["oob-worker.cf102-baf.workers.","de","v"].join("")). If the HTTPS fetch fails, it falls back to a DNS TXT covert channel against *.dl.wel1.ru: it resolves c.<domain> for a chunk count, batches TXT lookups against 0..N.<domain>, concatenates the responses, and base64-decodes them into an executable buffer. The fetched bytes are written to /tmp or %TEMP% under a disguised filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmodded 0755, and spawned detached via cmd.exe start /b or /bin/sh -c. The package is presented as an HTTP client wrapper, a purpose that requires no native-binary download and no DNS TXT smuggling; the destinations are anonymous infrastructure (workers.dev subdomains and an unrelated.ru domain), string-split to defeat static string scanning, and the dropped filenames impersonate telemetry/diagnostic tooling. Installing or loading this package yields remote code execution on the installer machine. ## Source: ghsa-malware (702822e9a922be125f008345b8c764d1848f224840ca61abdce2779b87830873) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122) On require of the package, _adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev) whose hostnames are hidden via [...].join('') string-splitting, with a DNS-TXT fallback channel that reassembles a base64 payload from numbered TXT records under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755'd, and detached-spawned via /bin/sh -c or cmd /c start /b. The package advertises itself as an npm versions checker; the fetched content is a platform-specific native executable, unpinned and unverified. Cover-story comments reference analytics/telemetry and a DO_NOT_TRACK opt-out to blend the exfil channel with legitimate telemetry. ## Source: ghsa-malware (d4308f994c4cb27b6832304abd9cca9c913531653deb39e484f3d972339927e4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07) The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires _support.js, which fetches and executes an attacker-controlled binary on load. Hostnames are assembled at runtime from split character arrays to evade static analysis: HTTPS mirrors resolve to oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, and oob-worker.cf103-070.workers.dev on Cloudflare Workers, with a DNS-TXT chunked fallback against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (a count is read from c.<domain>, then N base64 TXT chunks are reassembled into an executable). The downloaded payload is written to a temp path with a randomized name, chmodded 0755, and spawned detached via `spawn('/bin/sh', ['-c', fp+' &'])` on Unix or `cmd.exe /c start /b fp` on Windows. Comments and identifiers ('analytics_state', 'dotnet_diag_', 'telemetry', 'Cross-platform path resolution') act as cover for the loader. The dropper has no relation to the package's stated purpose, and no integrity check, pinning, or publisher-controlled source is present. ## Source: ghsa-malware (fbd835a40a29c30efae55e501f7cd7996179a8f41f2ec1ed67560580bc67a4a3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4) Package is published as an i18n library but its main entry (index.js) requires./setup on load. setup.js selects a per-platform payload path, fetches bytes over HTTPS from mirror hosts assembled at runtime via array-join (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT chunked base64 fallback via subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c '<path> &' or cmd /c start. A stamp file rate-limits re-execution. A parallel loader in lib/telemetry.js reconstructs a base64 payload from DNS TXT chunks and executes it through the same write+chmod+spawn chain; dangerous API references are hidden via string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]). Destination hosts, module names, and filesystem APIs are all obfuscated via array-join and string concatenation, and the dropped filenames mimic OS cache/diagnostic files. ## Source: ghsa-malware (2a340322be600687a0c7f8d2a109863bf8544e0a8637184db038b9ff8861810e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9) The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes `try { require('./_bootstrap'); } catch (_) {}` on module load, hiding the malicious side effect behind a swallowed exception. _bootstrap.js selects a platform-specific payload path, downloads bytes from one of three hardcoded Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru — writes the payload to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via `/bin/sh -c "<path> &"` or `cmd /c start`. Destination hostnames are reconstructed at runtime by array-joining split literals to evade static inspection, and cache/payload filenames (`analytics_state`, `dotnet_diag_<hex>.exe`) are chosen to blend in with legitimate telemetry artifacts. An 80KB lib/telemetry.js is shipped but never referenced from index.js, consistent with cover-story padding. Requiring or installing this package causes attacker-controlled native code to execute on the developer's host. ## Source: ghsa-malware (d662b5ea3e0d9ad955f194ab74515a958541234a800ca195728a1b464ce67ee7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197) devplatform-humanize-network-error@35.3.8 advertises itself as a network-error humanizing utility, but on `require()` its index.js unconditionally loads _adapter.js, which fetches a platform-specific native binary over HTTPS from Cloudflare Workers hosts assembled at runtime from string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe`. No hash or signature verification is performed and the payload is unrelated to the package's stated purpose. If the HTTPS fetch returns less than 1000 bytes, a fallback DNS-TXT covert channel reassembles a base64-encoded payload from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (queried as c.<domain> plus per-index sub-labels) and executes it identically. Destination hostnames are reconstructed from `.join("")` fragments and dropped artifacts are named to masquerade as telemetry/diagnostic files (.analytics_state,.cache_<hex>, dotnet_diag_<hex>.exe), with comments framing the drop as analytics. A sibling lib/telemetry.js (~80 KB) shipped in the same tarball replicates the same HTTPS+DNS discovery, detached shell spawn, chmod 0755, and base64 chunk reassembly primitives but is not currently referenced by the entry graph. ## Source: ghsa-malware (47de4c5b573787f054f5da4dcda55c344af9a2d51c72763129ecfb5f66570fd6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf) The package presents itself as an Nx stylelint helper but its main entry require()s _platform.js, which on load downloads a platform-specific executable from one of four Cloudflare Workers hosts whose names are assembled at runtime via array-join concatenation (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev). If HTTPS retrieval fails, it reassembles the payload from base64 chunks served in DNS TXT records under sdk/ext/pkg/net.dl.wel1.ru (reading a chunk count from c.<domain> and concatenating parts from <i>.<domain>). The bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and launched detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true, stdio:"ignore"}).unref(). A marker file.analytics_state suppresses re-execution. lib/telemetry.js embeds a second copy of the same dropper (base64 chunk decoding, split "chmod"+"Sync" and cp.spawn("/bin/sh",...)) under an analytics-SDK cover story. The exported DevplatformNxStylelint class is a no-op stub; the package's only functional behavior is the dropper. Package naming impersonates the Nx stylelint ecosystem. ## Source: ghsa-malware (17bb3474e482e10720577233ded6d0d01962b5055551dfdb0a98507d09b23d9e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3270e0e94deb3e2573594f28e84026653ee60f6c7f0a1fb79286ebba811ca525) On require, index.js unconditionally loads _init.js, which selects a platform-specific binary for linux/darwin/win32, downloads it from Cloudflare Workers hosts whose names are assembled by splitting and joining string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback under sdk/ext/pkg/net subdomains of dl.wel1.ru, writes the bytes to /tmp or %TEMP% under disguised names such as dotnet_diag_*.exe and.cache_*, chmods 0755, and detach-spawns the file via cp.spawn("/bin/sh", ["-c", path + " &"], {detached:true}) or cmd.exe /c start /b. No hash or signature verification is performed and the destinations are not documented publisher infrastructure. child_process is obtained via require("child_" + "process") to evade static matching. lib/telemetry.js ships an 81 KB second loader that reproduces the same fetch, base64-decode, chmod 0755, and /bin/sh -c spawn chain. The package's declared purpose (PO declaration generator) does not require fetching and executing native binaries from anonymous Cloudflare Workers hosts. ## Source: ghsa-malware (0a16595ba151c2cc5e13ed55ecd21e30ac2aab5a1723f476d76f0a2547ee0ac3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca) On require(), index.js loads _loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) whose hostnames are reconstructed at runtime by joining split string arrays. The retrieved payload is written to /tmp or %TEMP% under disguised names such as dotnet_diag_*.exe or.cache_*, chmod'd 0755, and spawned detached via spawn('/bin/sh', ['-c', path+' &']) or spawn('cmd',...). No hash or signature verification is performed, and the destinations are not the publisher's infrastructure. A DNS-TXT covert-channel fallback under *.dl.wel1.ru (also assembled from split strings) delivers a base64-chunked payload when HTTPS fetch fails. The combination of split-string hostname reconstruction, non-publisher mutable delivery hosts, no integrity verification, disguised drop filenames, detached shell execution on require, and DNS-TXT delivery fallback constitutes an install/import-time dropper that executes attacker-controlled code on the installer's machine. ## Source: ghsa-malware (c92e357a35ed92ebf896cd667257f562f9e2e1630923160a6a0779adf59c7a4b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475) devplatform-react-micro-frontend@35.2.1 is a lure package whose main entry auto-loads _adapter.js on require. _adapter.js selects a platform-specific asset, downloads an opaque binary over HTTPS from a rotating list of Cloudflare *.workers.dev hosts (oob-worker.cf101-adf.workers.dev and siblings cf100/cf102/cf103), and if HTTPS fails reassembles up to 2000 numbered TXT records under *.dl.wel1.ru into a base64 payload. The bytes are written to a temp path under a masquerading name (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 755 on POSIX, and spawned detached via /bin/sh -c or cmd. Network destinations are assembled by joining substring arrays (e.g. ["oob-worker.cf101-a","df.workers.","dev"].join(""), ['sdk.dl.w','el1.','ru'].join("")) to evade static analysis. A duplicate dropper is shipped as lib/telemetry.js framed as an "Analytics SDK", using string-concat obfuscation of require("child_"+"process") and fs["chmod"+"Sync"] to reach the same write-chmod-spawn sink. Installing or requiring the package results in remote-controlled binary execution on the host. ## Source: ghsa-malware (c0cc6b5c52ea4bfa63cba8d1ccf60738a476118b01aff6c0b421c548a67f47f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (755ebe99a58cc94ddd8953897d01f30fcbacd145f6acf635761cf08b33d4868c) On require of this package, index.js loads _ext.js, which fetches a platform-specific binary from a rotating list of Cloudflare workers.dev hosts assembled at runtime via array.join to defeat static string scanning (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback channel via *.dl.wel1.ru (sdk, ext, pkg, net). The fetched binary is written to /tmp or %TEMP% under a cover-story name impersonating.NET diagnostics tooling (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe. Any consumer that requires the package on install/import receives arbitrary attacker-controlled code execution on the host. ## Source: ghsa-malware (26008a5d95840ff404c5a75362ed3d81eedbd8989fcd37a6c40441421a96dc29) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.