Search: at.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6) On require('devplatform-react-form'), index.js loads _adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to /tmp or %TEMP% under deceptive names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0o755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true, stdio:'ignore'}).unref(), using a stamp file to avoid re-execution. Host and API strings are assembled from split fragments (e.g. ["oob-worker.cf102-baf.wo","rk","ers.de","v"].join(""), require('child_'+'process')) to evade static analysis. lib/telemetry.js contains a parallel dropper under an 'Analytics SDK' cover story using the same base64-chunk-decode + chmod 0o755 + cp.spawn('/bin/sh',...) pattern. The package advertises itself as a React form library but ships no form code; the fetched binary is unrelated to any documented purpose and delivers full-host code execution to any process that imports the module. ## Source: ghsa-malware (fc0f91cbc7f0e536c29d88d9d3de899ec807709956527adb6e7229664f2d1c5f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c) On require of the package, index.js loads _helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev), downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. A DNS-TXT fallback channel base64-decodes multi-record TXT responses from sdk.dl.wel1.ru into the payload bytes. lib/telemetry.js (~81 KB, framed as an analytics SDK) duplicates the same fetch-decode-chmod-spawn primitives. Hostname reconstruction via runtime string splitting, hex-random staging paths, disguised filenames (dotnet_diag,.cache_,.analytics_state), and the DNS-TXT covert transport are attacker infrastructure rather than legitimate library behavior. ## Source: ghsa-malware (6580ac910eec3a2cb20ce2e935a39da2549948bc1c702be53f911dfbac8d06ba) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b5813e9b97274c2eb3abd3459781550762baeea8c8fc0cec09603dac56a405d8) On require('devplatform-rest-client'), index.js loads _init.js which selects a platform-specific endpoint, downloads a binary from one of three Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback across four *.dl.wel1.ru subdomains, writes the payload to /tmp or %TEMP% under disguised names (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hosts and filenames are runtime-assembled from split string arrays; a cache-stamp file is named.analytics_state to mimic telemetry. A sibling module lib/telemetry.js (~81 KB, not referenced from index.js) contains a parallel dropper using indirect requires ('child_' + 'process'), base64 payload reassembly, chmod 0755, and detached /bin/sh spawn under a fabricated 'Analytics SDK' cover story. None of this behavior matches the package's advertised purpose as a REST client; index.js is trivial. ## Source: ghsa-malware (fbbcf53c505e7b9959afb047beac4365085ad239d61bae6098574e23f03a7771) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882) devplatform-select-fields@35.2.6 executes a binary dropper on any require() of the package. index.js loads _shim.js, which reconstructs C2 hostnames from split string fragments (Cloudflare Workers hosts of the form oob-worker.cf*-*.workers.dev, plus *.dl.wel1.ru), downloads a platform-specific payload over HTTPS, and falls back to a covert DNS TXT channel (reads a count from c.<domain> and reassembles a base64 payload from numbered TXT records). The payload is written to /var/tmp or %TEMP% under cover-story names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod 0755'd, and spawned detached via spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...). No hash or signature verification is performed. A setup() gate honors DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and writes an.analytics_state cool-down stamp (22583s) to suppress re-execution, framing the dropper as telemetry. Hostname string-splitting and the DNS-TXT reassembly path are anti-analysis measures. The package name resembles unrelated legitimate packages but the shipped code performs no advertised functionality. ## Source: ghsa-malware (65ad66039e3b7f7982e6539751ee90ae748d1de73569af1765aa15b4d1e0879a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26) index.js requires./_polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers subdomains (oob-worker.cf100-*.workers.dev / cf101/cf102/cf103 variants) with a DNS TXT chunked-base64 fallback via *.dl.wel1.ru. The payload is written under /var/tmp or %TEMP% with a cover-story name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0o755, and detach-spawned via /bin/sh -c "<file> &" or cmd.exe /c start /b. Destination hostnames and the child_process require are assembled by array-join string concatenation to evade static inspection. A second implementation of the same drop-and-exec chain (endpoint rotation, DNS TXT failover, chmod 0755, /bin/sh spawn) is present in lib/telemetry.js. There is no hash or signature verification, the hosts are anonymous mutable Cloudflare Workers unrelated to any declared publisher, and execution occurs automatically when the module is required. ## Source: ghsa-malware (36443e0787665837807370cbdc48a50575843492f93f4f657f3bb8b68bf54384) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cb9472f7623159163739228ed6ec07beb8599d3867f7c5215e4bf0e4bbde5a78) On require() of the package, index.js loads _vendor.js, which selects a platform-specific payload URL by joining string fragments to reconstruct Cloudflare Worker hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT chunked base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (e.g. 'dotnet_diag_*.exe', '.cache_*'), chmod 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() or spawn('cmd',...). Hostname fragments are array-joined at runtime and a helper suppresses console output, deliberately evading static inspection. The package name resembles a legitimate SPA plugin but the shipped _vendor.js is a dropper granting arbitrary remote code execution on any host that imports the module. ## Source: ghsa-malware (efc283f86f94400db2d3b8e9aea0b1c936d347f16a36df77dde30b00eb2c7980) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e) On require() of the package, index.js loads _runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscated Cloudflare Workers hosts (hostnames assembled at runtime via array-join, e.g. 'oob-worker.cf<NNN>-<hex>.workers.dev'), with a DNS TXT-record fallback channel under 'c.<domain>' / 'N.<domain>' that returns base64-encoded chunks decoded into the payload. The downloaded bytes are written to /tmp/.cache_<rand> (chmod 0755) on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, and spawned detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}).unref() or a cmd equivalent. Destinations are unrelated to the package's stated cobrowsing purpose, hostnames are obfuscated to defeat static analysis, and the payload is executed with no integrity check. ## Source: ghsa-malware (aa1e66a1340ad906053aaac4b55743c6d3e7efd724f6db8b8b81b7921962eb02) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (809274addc0525244480b108485ad3dbdba1a92b65025c1c48d549dd03c45f0b) On require of the package, index.js loads _bridge.js, which assembles platform-specific destination hostnames via string-split/array.join obfuscation and downloads an opaque binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked fallback channel (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<rnd>, dotnet_diag_<rnd>.exe), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(), with a marker file used to gate re-execution. A sibling module in lib/telemetry.js resolves child_process via 'child_' + 'process' string concatenation, corroborating deliberate static-analysis evasion. Importing this package causes an attacker-controlled native binary to execute on the installer's machine. ## Source: ghsa-malware (6eae746404d92a5c5a06e6a6c0f193dfe1cd697841d04c825513c6d711fad214) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8) index.js unconditionally requires./_loader on load. _loader.js reassembles Cloudflare workers.dev hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) from split-string arrays, with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (chunk-count from c.<domain>, base64 chunks from numbered subdomains). It fetches a platform-specific native binary, writes it to /var/tmp or %TEMP% under cover names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods 0755, and spawns it detached via /bin/sh -c '<file> &' or cmd /c start. A second module lib/telemetry.js (~81KB, disguised as an analytics SDK) duplicates the same fetch+chmod+spawn primitives using string-concatenated identifiers (require("child_"+"process"), fs["chmod"+"Sync"]) as a redundant stage. The i18next plugin name and analytics_state marker do not correspond to any translation functionality shipped in the tarball. ## Source: ghsa-malware (b670b9722893bc27a1131c64b73b381cba3d68d041a280457e8806a427ed5e2c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896) On require of the package's main entry, _support.js runs an init() routine that assembles destination hosts from split string fragments (oob-worker.cf100-416.workers.dev and siblings cf101/cf102/cf103, with a *.dl.wel1.ru DNS-TXT fallback), fetches an unsigned binary payload via https.get (or reconstructs it by concatenating base64 fragments across sequential DNS TXT subdomains c./0./1./…), writes the bytes to a disguised path (dotnet_diag_<hex>.exe under TEMP on Windows,.cache_<hex> under /var/tmp on POSIX), chmods 0755, and detached-spawns it via cp.spawn('/bin/sh', ['-c', path+' &'], {detached:true}) or cp.spawn('cmd.exe', ['/c','start','/b', path]). No hash or signature verification is performed and the destinations are not the package's publisher. Execution is gated to skip when DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are set or when npm_lifecycle_event === 'preuninstall', consistent with evasion of developer/CI/analyst environments. Host-string splitting and the DNS-TXT payload channel are evasion techniques that defeat naive static grep for the destinations. ## Source: ghsa-malware (7fe06d42c0c7ea9d4d5657015f0708a28ef85401c31872ac63709d61ed54f810) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (282ec333b26c6283eb35916acab1db10c1362d296d0694b1548882c6e48c06be) The package's main index.js unconditionally requires./_ext, which runs at load time and fetches a per-platform binary over HTTPS from string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev). If HTTPS fails, _ext.js falls back to a DNS TXT covert channel under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), querying c.<domain> for a chunk count then 0.<domain>, 1.<domain>,... and base64-decoding the concatenation into a binary. The fetched bytes are written to a randomly-named file in the temp directory (masquerading as.cache_<hex>, dotnet_diag_<hex>.exe, analytics_state), chmod'd 0755, and spawned detached via /bin/sh -c or cmd /c start /b. There is no version pinning, hash verification, or publisher-owned CDN, and the package's stated purpose (an SPA error-boundary component) has no legitimate reason to fetch and execute a native binary. Endpoint hostnames are assembled from split array literals at runtime to defeat static string scanning. Loading this package causes arbitrary attacker-controlled code to run on the installer's host. ## Source: ghsa-malware (52a6a2f9ca87decad3081725ea4293dce82d4c33a5afe1fdb9774776b95760be) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08) On require() of the package, index.js loads./_ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback under *.dl.wel1.ru. The fetched bytes are written to a randomly named file in /var/tmp or %TEMP% (disguised as.cache_<hex> on Unix or dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe. Destination hostnames are split into array fragments and joined at runtime (['oob-worker.cf99','-9b3.workers','.de','v'].join('')) to defeat static scans, and the surrounding identifiers ('analytics_state', 'DISABLE_TELEMETRY', 'dotnet_diag_') present the behavior as telemetry. The fetch is unpinned, unverified, and executed from anonymous worker hosts with no relation to the package's declared purpose (a SPA router plugin). ## Source: ghsa-malware (b3f86e455b8cc322c2fa742eddaef6758e264d1c9a5f07b9511e0911ef074265) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a) Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires _bootstrap.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with hostnames reconstructed at runtime via array-join to evade literal detection, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh or cmd. If HTTPS mirrors fail, a DNS-TXT fallback channel queries c.<domain> at sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru for a chunk count and reassembles base64-encoded payload chunks from N.<domain> TXT records. A second file lib/telemetry.js contains an unreferenced variant of the same dropper. The Cloudflare Workers and wel1.ru destinations are unrelated to any legitimate Sentry infrastructure, and the package's advertised functionality is a cover story around the dropper. ## Source: ghsa-malware (f76cb55af9e854ca5d57e6b318ae84ac06c517b98e7628117cc949f69c5c84fc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7) index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf101-adf, cf99-9b3, cf100-416) with DNS-TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or a Windows temp path named dotnet_diag_<hex>.exe, chmod'd 0o755, and detached-spawned via /bin/sh -c or cmd.exe /c start. Hostnames and dangerous API names (child_process, chmodSync) are reconstructed from split literal arrays to evade static analysis, and there is no hash or signature verification of the downloaded payload. A second implementation of the same download-chmod-spawn pattern is present in lib/telemetry.js (~81KB), framed as an 'Analytics SDK', though it is not reached from the current main entry. Executing require() on this package causes attacker-controlled native code to run on the installer's machine. ## Source: ghsa-malware (ccbbaf9a76f0fb8271605d97295f16ee50f771f45057412a890cd08a0b0623e6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The npm package 'gekko-trading-bot' version 4.2.0 contains malicious code that downloads and installs an attacker-controlled executable named core.exe during installation on Windows systems. This executable is fetched from a Cloudflare Workers subdomain impersonating MetaMask but unrelated to the legitimate Gekko trading bot. The package metadata misleads users by mimicking the legitimate project while pointing to a different repository. The malicious binary is placed in the user's home directory without verification, posing a significant security risk.

The npm package caldora version 1.0.0 contains malicious code that executes on import when run in a Linux environment with the Windows Subsystem for Linux (WSL) present and NODE_ENV not set to 'production'. It downloads a binary from a third-party file host and writes it as 'vite-native-helper.exe' into the Windows user's Startup folder, enabling persistent execution on the Windows host at next login. The payload is obfuscated by splitting the URL into parts and is dormant in typical developer or CI environments, targeting WSL developer hosts specifically. The package's declared functionality does not require this native helper, indicating malicious intent.

The streak-bucket-core npm package version 1.0.0 contains embedded malicious code that writes a Windows PE executable to the current user's Startup folder upon import or require on Windows hosts. This executable, disguised as vite-native-helper.exe, is configured to auto-run at every user logon, enabling persistent execution. The malicious payload is concealed via hex encoding and embedded directly at the module's top level, making the infection automatic upon usage of the package.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85) On require() of pfp-block-mobile-past-meetup-list, index.js loads _ext.js which runs a bootstrap routine. It fetches a platform-specific binary via https.get from one of three Cloudflare Workers hosts (oob-worker.cf1-03-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback resolved through tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched payload is written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. The C2 hostnames and DNS resolvers are constructed by joining arrays of substrings to evade static detection. Filenames mimic Windows dotnet diagnostics tooling and Unix hidden cache files. The package advertises itself as a mobile SDK but ships no SDK code — only an index.js stub and the _ext.js dropper. Environment checks against DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and a /tmp stamp file provide analytics cover. No hash or signature verification is performed on the downloaded payload; the destination hosts are attacker-controlled and mutable. ## Source: ghsa-malware (89cfeac84b4056bcedb77e7b34cf5ef321a1f9af8aaf2f41bf24a8d62e299dd2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fb43194ddda04c3dffa5cb6bea02c8bc6edba8623acf172c5da744b2488e13b0) On require, _compat.js selects a platform-specific payload path and downloads an opaque binary from one of four Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev). Origin hostnames are assembled from split-string fragments joined at runtime to hide the destinations from static inspection. The fetched bytes are written to a hidden file staged as a system-artifact lookalike (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix) in /tmp or %TEMP%, chmod 0755, and executed via spawn("/bin/sh", ["-c", <path> + " &"], {detached:true, stdio:"ignore"}).unref() (or the cmd equivalent on Windows). If the HTTPS fetch fails, the loader falls back to a DNS TXT covert channel, querying subdomains under dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) for base64-encoded payload chunks that are concatenated and executed the same way. The package advertises itself as a domain-event handler; the fetched executable content has no relationship to that stated purpose. ## Source: ghsa-malware (8c296a5b9bfc1ba39942ffe8c574ae28d8ab44305cf97ca0767cf6c5b73a5115) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5) On require() of the package, index.js loads _loader.js which unconditionally executes init(). init() selects an OS-specific payload path, downloads an opaque binary via HTTPS from author-controlled Cloudflare Workers hosts (oob-worker.cf10x-*.workers.dev) with a base64-over-DNS-TXT fallback under *.dl.well1.site, writes the bytes to a disguised temp file (dotnet_diag_<hex>.exe on Windows or.cache_<hex> under /var/tmp), chmods 0755, and spawns it detached via spawn("/bin/sh") / spawn("cmd"). Destination hostnames are assembled at runtime from small string fragments joined with Array.join to defeat naive string scans. A cache-lock file at /tmp/.analytics_state (or %TEMP%\analytics_state) with a ~6-hour TTL rate-limits re-execution across imports, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var checks serve as a telemetry cover story while the actual behavior is remote-binary drop-and-execute. The fetched bytes are attacker-controlled and unpinned (no hash, no signature, no vendor-matching publisher domain), so any consumer that requires this package runs whatever the operators serve at the moment of install/import. ## Source: ghsa-malware (aa6d80458d94fbe93b9d1ff8ae43781e1b07bd33ba06cf0c8269fcc79500d839) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.