Search: at.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26) On `require`/`import`, `_compat.js` (reached from `index.js`) downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains (`oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf103-070.workers.dev`) with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered subdomains under `well1.site` (`c.<domain>`, `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site`). The fetched bytes are written to `/tmp/.cache_<hex>` on Unix or `%TEMP%\dotnet_diag_<hex>.exe` on Windows under disguised cache/diagnostic names, chmod +x'd, and spawned detached via `/bin/sh -c '<path> &'` or `cmd`. The C2 hostnames are constructed by joining split string fragments to evade static analysis. A cooldown flag file (`/tmp/.analytics_state` or `%TEMP%/analytics_state`) suppresses re-execution for ~22046 seconds, and execution is gated on `DISABLE_TELEMETRY` / `ANALYTICS_OPT_OUT` / `DO_NOT_TRACK` env vars as a telemetry cover story. The destinations are anonymous Cloudflare Workers subdomains and a lookalike DDNS-style domain unrelated to any legitimate publisher; no integrity verification is performed on the downloaded binary. ## Source: ghsa-malware (b65fe20ba064c24727682a5b30644004edf48aee92b5317d9332e31c02910269) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9) sme-scripts-shared-library-webpack-plugin@20.2.9 executes an install/import-time dropper. index.js requires./setup at module load, which selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from a rotating list of *.workers.dev hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev), with a DNS-TXT chunked base64 fallback channel over *.dl.well1.site (tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). Fetched bytes are written to /tmp or %TEMP% under decoy names ('.cache_<rnd>' on POSIX, 'dotnet_diag_<rnd>.exe' on Windows), chmod 755, and launched detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or cmd.exe. Endpoint hostnames and discovery domains are string-split across arrays and rejoined at runtime to evade literal-URL scanning; artifact names impersonate legitimate telemetry/system files. lib/telemetry.js ships a second parallel dropper framed as an 'Analytics SDK' that assembles bytes from a DNS-chunked base64 source and executes them the same way. No hash or signature verification is performed on any fetched payload. ## Source: ghsa-malware (dcfe07f5684385487f2d1633a4e3fb2c89bce7489457e14bebefb93782974960) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245) On require() of the package, index.js loads _ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames (oob-worker.cf99-9b3.workers.dev, cf100-416, cf101-adf, cf103-070) with a DNS-TXT covert-channel fallback against subdomains of dl.well1.site (tin/ldr/win.dl.well1.site) that reassembles base64 chunks into executable bytes. The fetched payload is written to /var/tmp or %TEMP% under disguised names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod +x'd, and spawned detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true}) or spawn("cmd",...). C2 hostnames are assembled at runtime via ["oob-work","er.cf103-07","0.workers.","dev"].join("") to defeat static string search. The package presents itself as a base framework typings module and ships an unreferenced lib/telemetry.js plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-out env vars as cover; the DNS-TXT path carries an inline comment describing it as chunked transfer for environments blocking HTTPS. ## Source: ghsa-malware (a0c5ac14d5ca2237a244551a8668e466e4f83d359a930dc35e57543405e4c14c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (192fac66540fb5d3f4c376673ddd67a4e43053342e745e538f7ddcc08b0a9042) index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, selects a platform-specific endpoint from four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_<suffix>.exe on Windows,.cache_<suffix> on Unix), chmods 0755, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). When HTTPS fetch fails, setup.js falls back to a DNS TXT-record channel under *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site): it queries a count record and then N chunk records, base64-decodes the concatenation, and executes the reconstructed payload — an evasion channel that bypasses HTTP egress filtering. The child_process module name and destination hostnames are runtime-assembled from split arrays to defeat static scanners; disguised filenames and an analytics/telemetry framing serve as cover. The fetch-and-execute path fires automatically whenever any consumer requires this package. ## Source: ghsa-malware (951066f8fd3f0cc78122046780b65659e2e22d1aa548afaeb26b8a8ca5bad739) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c) On require('trapp-configuration'), index.js loads _adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three Cloudflare Workers hosts whose hostnames are reconstructed by joining character-split arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /tmp or TEMP under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via child_process spawn against /bin/sh or cmd. There is no hash or signature verification. When the HTTP mirrors are unreachable, _adapter.js falls back to a DNS-TXT covert channel against *.dl.well1.site (c.<domain> returns a chunk count, then numbered TXT queries at N.<domain> are base64-reassembled into the same payload) and executes the reconstructed binary. Hostname string-splitting and system-artifact impersonation in the dropped file names are consistent with deliberate evasion rather than a build helper. ## Source: ghsa-malware (a2d58104b870146d82d76ecd070942f1e053a0bfb1de3ea939fa6a48a285dc94) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e) On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via `.join('')` from split string fragments (e.g. ['oob-worker.cf100-416.w','ork','er','s.de','v'].join('')), downloads an opaque native binary via https.get, writes it to a temp path under a cover-story name (`dotnet_diag_<hex>.exe` / `.cache_<hex>`), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true})` (or `spawn('cmd',...)` on Windows). If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel: `dns.resolveTxt` is called against `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site` (also assembled from split fragments), and the TXT record contents are concatenated and base64-decoded to reconstruct the payload bytes. A `checkStamp()` flag file gates re-execution and stderr writes are used as silent no-op logs. The fetched binary is unpinned, unsigned, and unrelated to the package's advertised SDK purpose. ## Source: ghsa-malware (74e0f2d1d48f0a7879ceb5f476c7b45f9699402fecaa46060ee1cf06b09bf197) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc) boxy-fixture-allure ships an index.js that unconditionally requires./_shim on load. _shim.js reconstructs C2 hostnames via runtime string-splitting/.join() over fragments (assembling *.workers.dev CDN endpoints and a DNS TXT-record fallback under *.well1.site), fetches a platform-specific native binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0o755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Payload naming (dotnet_diag,.cache_, analytics_state) and the presence of opt-out environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) serve as cover for the drop-and-execute behavior. The fetch fires on every require() of the package, so any install or import runs attacker-controlled code on the host. ## Source: ghsa-malware (8c900b94efc137cab350c98b3fed461c9b172e9bda43ff02312f879c3f24bc71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416) On require/import of this package, index.js unconditionally loads _runtime.js, which fetches a platform-selected binary from rotating Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) with a DNS-TXT chunked fallback via *.dl.well1.site, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive identifiers (child_process, chmodSync) are reconstructed at runtime via string-split join and dynamic property assembly to evade static analysis. A secondary module lib/telemetry.js is framed as an analytics SDK but ships the same base64-decode + chmod-0755 + /bin/sh -c spawn dropper capability. The delivery infrastructure is anonymous, mutable, and unrelated to any legitimate publisher; the executed bytes are opaque and attacker-controlled. Installing or loading this package results in arbitrary code execution on the installer's host as a detached background process. ## Source: ghsa-malware (25ab3231ed87aecbeb2d2413ed8b7372856199f7cefecbc8d7ee062e5e333bf2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a) On require(), _polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several *.workers.dev hosts whose names are assembled at runtime by joining split string fragments, writes it to /tmp or %TEMP% under a decoy name such as dotnet_diag_<rand>.exe or.cache_<rand>, sets mode 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-over-TXT fallback channel reassembles a base64 payload from numbered TXT records under *.dl.well1.site. Hostnames are constructed from arrays of fragments to evade string search, and a cooldown state file gates re-execution. The package advertises a 'merchant service layer' role and ships no legitimate need for a hidden native payload dropper. ## Source: ghsa-malware (01be161bf71b08510ee30bb6263e865bf9022ea2b966cfd457fd7d1ca5719cb6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15) On require() of the package, _support.js assembles remote hostnames from split-string array joins (e.g. ["oob-wo","rker.cf1","02-baf.workers.","dev"].join("")) to hide Cloudflare Workers-hosted download origins and a DNS-TXT fallback under *.dl.well1.site. It selects a platform-specific path, downloads an opaque native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0o755 on POSIX, and spawns it detached (detached:true, stdio:"ignore",.unref()) via /bin/sh -c or cmd.exe /c start /b. A marker file.analytics_state throttles re-download to ~6.5 hours (EXPIRE_SEC 23327s) so subsequent requires do not re-trigger the fetch. The package name resembles legitimate scoped packages while shipping only a binary-dropper import-time payload; a DISABLE_TELEMETRY opt-out and "analytics" naming provide cover-story framing over the fetch-write-chmod-spawn chain. ## Source: ghsa-malware (ad6959e1bd9f23751057c2c7d61d91cc3a6bf7dff795ad045271dabaac5c77eb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59) index.js unconditionally require()s _bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string concatenation to hide them from static scanners (oob-worker.cf101-*.workers.dev variants, with DNS TXT-record fallback resolution against tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), downloads a platform-specific binary via https.get, writes it to /tmp or the Windows TEMP directory under names mimicking OS internals (dotnet_diag_<hex>.exe,.cache_<hex>), fs.chmodSync 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start. A sibling file lib/telemetry.js (not reachable from the main entry) contains matching dropper primitives — base64 chunk assembly, cp.spawn("/bin/sh",...), fs["chmod"+"Sync"] with parseInt("755",8) — under an analytics-SDK cover story, indicating a staged variant. The require() chain fires as a side effect of importing the package, so any consumer that installs and loads it executes attacker-controlled binaries on the host. ## Source: ghsa-malware (7c982aa407e479ed7613d1669e985d0a2439fd9b5910034ef42b13c9d62f84d8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8e9cb745c0771868eb6908cf1c783614da3e41fe1d1cf52b4d2d04705c51af19) On require of the package's main, index.js side-loads _runtime.js which selects a per-platform payload path, fetches an opaque binary from string-split obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /var/tmp or %TEMP% with a disguised filename (`.cache_<hex>`, `dotnet_diag_<hex>.exe`, `.analytics_state`), chmods 0755, and spawns it detached via child_process.spawn('/bin/sh') or spawn('cmd'). When the HTTPS mirrors fail, _runtime.js falls back to a DNS TXT covert channel: it resolves `c.<domain>` for a chunk count, iterates `<i>.dl.well1.site` TXT records (tin/tina/ldr/win subdomains), concatenates and base64-decodes them into the payload, then writes and spawns it. Host names, fallback DNS domains, and the string 'child_process' are assembled from split string arrays at runtime to evade static analysis. There is no version pinning, hash check, or signature verification, and the destinations are not the publisher's infrastructure. Cover-story framing as an 'Analytics SDK' with a DISABLE_TELEMETRY opt-out does not match the actual fetch-decode-write-chmod-spawn behavior. ## Source: ghsa-malware (e476a87c0e4538a947633f4bd6a61d856208adab0161811adf5ae087c9b02915) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The quorvex npm package versions 0.2.0 and 0.2.1 contain malicious code that drops a base64-encoded Windows executable to the user's Startup folder on Windows hosts with more than 4GB of RAM. This executable, named vite-native-helper.exe, is designed to run automatically at user logon, establishing persistence. The package uses obfuscation and sandbox evasion techniques to ensure the payload executes when the module is imported. This behavior is hidden under a misleading package description and filename to avoid detection.

The npm package warp-drive-internal-tooling version 99.9.9 contains malicious code that executes a hidden PowerShell process during installation. This process downloads and runs an unverified binary named Verification_Tool.exe from an anonymous file hosting service, resulting in unattended execution of attacker-controlled code on Windows machines. The behavior is consistent with a dropper designed to conceal its activity.

The npm package calendar-streak-core@1.0.0 contains embedded malicious code that drops a Windows executable into the user's Startup folder, enabling persistent execution on Windows logon. The package falsely claims to be dependency-free and harmless, but it embeds a hex-encoded Windows PE executable that is decoded and written to %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. This behavior occurs immediately upon module import, allowing any project importing this package on Windows to gain persistent execution of the embedded binary.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828) On require() of the package, _init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare workers.dev hosts whose names are reconstructed from split-string arrays (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmods 0755, and spawns it detached via spawn('/bin/sh',['-c',fp+' &']) or spawn('cmd',...). A DNS-TXT fallback channel resolves numbered subdomains under dl.well1.site (also assembled from fragmented array joins) and base64-decodes the concatenated TXT records when HTTPS retrieval fails. A hidden stamp file (.analytics_state) with a ~6.3-hour TTL throttles re-execution to establish recurring background execution, and the code short-circuits only on well-known opt-out envs (DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK), impersonating legitimate telemetry artifacts. The package name and telemetry cover story do not match the observed behavior: fetching opaque attacker bytes and executing them detached is a canonical binary-runner dropper. ## Source: ghsa-malware (90cc41b3eebdcc98e1029c6bd67225397224c7bc14806958720846c4905946c7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12) index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection (assembling `oob-worker.cf10[0-3]-*.workers.dev` mirrors plus a DNS-TXT fallback under `*.dl.well1.site`), fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story filenames (`dotnet_diag_*.exe`, `.cache_*`, `.analytics_state`), sets mode 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` (or the cmd equivalent on Windows). Cover-story comments reference SHA-256 integrity checking and load-distribution shuffling, but no such operations are performed on the fetched bytes. lib/telemetry.js ships duplicate dropper primitives (`Buffer.from(chunks,'base64')`, detached `/bin/sh -c` spawn, `fs['chmod'+'Sync'](extensionPath, 0o755)`) inside an 81KB file presented as an analytics SDK. The package's declared purpose (finance entity-group models) has no relationship to fetching and executing native binaries from Cloudflare Workers subdomains. ## Source: ghsa-malware (7d4e71e1e8685df7456f7f02707407ca56b53447ad43b994e3d57b2dba4478c4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (91b37a5aa06b2d75f250bd23ce01f2667646c1aa7609ec2323f226842e043e9d) streak-calc-metrics@1.0.0 is presented as a native math accelerator for streak calculations but ships a bundled Linux ELF at dist/calc.bin that the main module unconditionally chmods and spawns detached at import time (cp.spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true })). The ELF self-identifies as 'REDSHELL' and beacons to hardcoded C2 IP 217.60.77.63 with the protocol tag SECURE_BEACON|...|REDSHELL, providing a full remote shell over /bin/sh and /bin/bash. The implant downloads and executes arbitrary ELF binaries and shellcode over plain HTTP with TLS verification disabled from http://217.60.77.63/Others/<name> and http://217.60.77.63/SC/<name>, staging into /tmp/.elf_* or via memfd_create (syscall 319) and chmod +x before execution, with no hash or signature check. It exposes command handlers /ssh_keys, /creds, /dbfind, /env, and /dataextract <path> that harvest the installer's SSH keys, credential files, environment variables, and arbitrary filesystem paths, then exfiltrates them in chunks via POST /api/extract-receive using markers such as BIGEXTRACT_START and Destination: Loot_%s_%s_%s. Persistence is established by writing ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, Restart=always) and enabling it with systemctl --user daemon-reload && systemctl --user enable --now svc-update.service. The implant additionally exposes a remote-controlled SOCKS5 proxy (/socks start <port>) and arbitrary TCP port forwarding (/portfwd start <lport> <rhost> <rport>), turning the installer's host into a pivot into internal networks. The JS wrapper contains a cover story ('Native accelerator loaded and verified', 'Performance mode enabled') and an inverted SHA-256 integrity check against 4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466 that never blocks execution. ## Source: ghsa-malware (96488efc57092e2b1f373623a88bf26607c9ece7ed95270327febc6b536d0d01) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139) The package's declared main (index.js) unconditionally loads _ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a temporary path under hidden filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), sets executable permissions via fs.chmodSync(path, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd. When HTTPS fetch fails, _ext.js falls back to DNS TXT resolution against *.dl.wel1.ru (sdk., ext., pkg., net.), reassembling base64 chunks from the TXT records into a Buffer and executing it — a covert channel designed to bypass HTTPS egress filtering. Destination hostnames and sensitive API names (child_process, chmodSync) are reconstructed at runtime from split string arrays to defeat static analysis. Cover-story comments frame the behavior as telemetry/analytics; the actual behavior is opaque, unpinned, unverified remote code execution on require of a package advertised as a UI hooks toolkit. ## Source: ghsa-malware (f5a1e30a7990931ff5444563b7075bb0571d6924bac069bc78c4c2f288f6b4b8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e) On require of the package, `index.js` loads `_polyfill.js` whose top-level `bootstrap()` fetches an opaque platform-specific binary over HTTPS from string-fragment-assembled hosts (reconstructing `oob-worker.cf101-adf.workers.dev` and `sdk.dl.wel1.ru`, with a DNS-TXT fallback for endpoint discovery), writes it to `/var/tmp` or `%TEMP%` under disguised names such as `dotnet_diag_<hex>.exe` and `.cache_<hex>`, chmods it 755, and spawns it detached via `cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}).unref()` (with a `cmd` branch on Windows). The download hostnames are assembled at runtime from split string arrays to evade static analysis. A second bundled module, `lib/telemetry.js`, implements the same fetch-write-chmod-spawn pattern using base64 buffer assembly and `fs["chmod"+"Sync"](..., 0o755)`. There is no version pin, no hash or signature verification, and the endpoint is not a first-party publisher domain. Installing or importing this package auto-executes attacker-controlled native code on the host. ## Source: ghsa-malware (dcb6256c0a6b54da5f083f0ebe7609d6b1d6b4a7b517c6008486e9050583d8bf) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.