Search: df.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0) On require(), index.js loads./_ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT covert-channel fallback that reassembles a base64 payload from numbered subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via spawn("/bin/sh", ["-c", path + " &"]) or spawn("cmd",...). Host strings are constructed via array-split.join("") to evade static inspection, and there is no hash or signature verification. Staging paths mimic system diagnostics names to blend in. ## Source: ghsa-malware (b9e509d532bb46f434ea0a124cf22b50558357d28e0a316974709d2a7bde00dc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6) On require(), _support.js assembles C2 hostnames via split/join fragments (resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev, cf101-adf.workers.dev) and downloads a platform-specific binary via https.get, with a DNS TXT fallback under dl.wel1.ru that reads a chunk count from c.<domain> and base64 chunks from N.<domain>. The fetched payload is written to %TEMP%/dotnet_diag_<hex>.exe on Windows or /var/tmp/.cache_<hex> on Unix, chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref(). A /tmp/.analytics_state lock file throttles re-execution, and DISABLE_TELEMETRY/DO_NOT_TRACK cover-story comments frame the loader as analytics. No hash or signature check is performed on the downloaded binary. The package name mimics a legitimate Vite plugin. ## Source: ghsa-malware (fd80bad16653380e79b1cbe72e8e4fc7c6912c9117d537c7f00c1d721cd1e7e6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7) On require() of dolyame-boxy-atom-bnpl-badge, _helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors (oob-worker.cf100-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-*.workers.dev, oob-worker.cf199-*.workers.dev) with a DNS-TXT chunked fallback through sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Destination hostnames and API names are assembled via array-join fragments (e.g. ['oob-worker.cf103-070.wo','rkers','.dev'].join(''); require('child_'+'process'); 'chmod'+'Sync') to evade static matching. The downloaded bytes are written to a disguised path in /tmp or %TEMP% as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755 on POSIX, then spawned detached with stdio ignored via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true,stdio:'ignore'}).unref(). No hash or signature verification. Execution is gated by a.analytics_state marker file and by env vars named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK to impersonate a telemetry opt-out. The dropper is unrelated to the package's stated BNPL-badge purpose. A sibling lib/telemetry.js frames the chain as analytics as a cover story. ## Source: ghsa-malware (1c18060fe7baa81c17babcf9cebc9469cdf1c4f3db464d6c638ad07532fa0f37) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98) On require of the package, index.js loads _loader.js which reconstructs attacker-controlled hostnames via string-split.join('') to evade scanners (mirrors of the form oob-worker.cf10{0,1,2}-{baf,adf}.workers.dev and DNS TXT fallback domains under wel1.ru such as sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), selects a platform/arch-specific asset, downloads a binary from one of the anonymous Cloudflare Workers hosts (with a DNS-over-TXT fallback that base64-reassembles bytes from <n>.<domain> TXT records), writes it to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawns it detached via /bin/sh -c or cmd.exe. A marker file named.analytics_state and comments referring to 'opt-out environment variables' present a telemetry cover story. There is no hash or signature verification on the downloaded bytes, the destinations are anonymous hosts unrelated to any legitimate publisher, and the package name itself is a lookalike combining unrelated brand/technology tokens. ## Source: ghsa-malware (2e59b1d946c38b9a6e256cc86700987daaf2338dba0e56b59a124da3e582af25) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320) On `require('dlp-dlp-core')`, index.js loads setup.js which selects a platform-specific path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), downloads bytes over HTTPS from string-obfuscated Cloudflare Workers mirrors (oob-worker.cf102-baf.workers.dev, cf103-070, cf100-416, cf99-9b3.workers.dev), writes them to /var/tmp/.cache_<hex> or Temp/dotnet_diag_<hex>.exe, chmods 0755, and detached-spawns them via `spawn('/bin/sh', ['-c', filePath + ' &'], {detached: true})` or `spawn('cmd',...)`. A fallback covert-retrieval channel uses DNS TXT lookups against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reassembling base64 chunks and executing the result. Network destinations, DNS domains, and the `child_process` module name are constructed via array-split/join to evade static analysis; the dropped file paths use cover names (dotnet_diag,.cache_,.analytics_state). lib/telemetry.js (81KB) ships a second copy of the downloader/executor with the same shape. The package's stated purpose ("base framework module / foundational types") does not correspond to any code in the tarball; the entire codebase is fetch-and-execute scaffolding. Env-var opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) provide a telemetry cover story. ## Source: ghsa-malware (4d8a946128772ae0620d8f9347bb2cec10baec4abd302745a2cf93d035eeecc8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143) On require, _adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp/.cache_<hex> or the Windows TEMP directory as dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Mirror hostnames are reconstructed from split string arrays joined at runtime to evade static scanners. If HTTPS retrieval fails, the module falls back to a DNS TXT covert channel under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru: it reads a count TXT at c.<domain>, pulls N base64-chunked TXT records from <i>.<domain>, concatenates and base64-decodes them, and feeds the resulting bytes into the same write-chmod-spawn pipeline. A lockfile at /tmp/.analytics_state throttles re-execution. lib/telemetry.js is a companion 81 KB module presenting itself as an observability SDK and contains the same write-chmod-spawn pattern with concatenation-obfuscated API names (require("child_" + "process"), fs["chmod" + "Sync"]). The disguised filenames, obfuscated destination reconstruction, and DNS-TXT covert-channel transport are deliberate evasion of egress filtering and scanning. ## Source: ghsa-malware (5b28949ae736b99d0d9789f12608af2d0682c50e64c8d4e11f18693dc74fe0be) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f) The package's main entry loads setup.js, which on require() fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime via array.join() (e.g. ['oob-worker.cf10','2-baf.w','orker','s.dev'].join('')) to evade static inspection. A DNS-TXT fallback channel under *.dl.wel1.ru retrieves base64-encoded chunks (count via c.<domain>, chunks via <i>.<domain>) that are concatenated and decoded. The retrieved binary is written to /tmp or %TEMP% under cover-story names (.cache_*, dotnet_diag_*.exe), chmod 755'd on POSIX via a split fs['chmod'+'Sync'] call, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or cmd on Windows). No lifecycle hook is required; any consumer that imports the package triggers execution. A sibling lib/telemetry.js, framed as an 'Analytics SDK' and not wired in, contains the same dropper primitives (split require('child_'+'process'), split chmodSync, base64 chunk assembly, detached /bin/sh spawn), indicating a shared dropper family. ## Source: ghsa-malware (0a1fd745615cbbe023dd51a927f26cd6c042778b201ed06dc6660a659c2153ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5) On require(), _compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains (assembled at runtime from split string fragments such as ["oob-work","er.cf100-416",".worker","s.dev"].join("")) with a DNS TXT fallback under dl.wel1.ru, writes it to /tmp or %TEMP% under a decoy name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via cp.spawn("/bin/sh",["-c", filePath+" &"], {detached:true}) or spawn("cmd",...). Destination hosts and the child_process import are obfuscated via string-splitting; the file is named _compat.js and gated behind opt-out env vars (DISABLE_TELEMETRY) as cover. A second parallel dropper is shipped in lib/telemetry.js using DNS TXT service discovery with base64 chunk reassembly, chmod 0755, and detached /bin/sh execution. Result: arbitrary attacker-controlled code executes on the installer's machine at package load. ## Source: ghsa-malware (d8f351426cc5b751dc039332982e5e2766e16f2c2bdf2d22410e5fea46058d5c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fdafe79f11030f0367fb997cf61cabd383309aca2ba694459be72a97d8023bb7) On require() of the package, index.js loads _helpers.js which immediately runs an init() routine that fetches a platform-specific binary over HTTPS from a set of hosts reassembled at runtime via string split-and-join: oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, and sdk.dl.wel1.ru, with a DNS TXT chunked-base64 fallback for host discovery. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmod'd 0755, and spawned detached via /bin/sh -c "<path> &" or cmd /c start. No hash or signature check is performed. A sibling file lib/telemetry.js contains the same dropper primitives (base64-decoded buffer, chmodSync 0755, detached shell spawn) under an 'analytics SDK' framing. Hostnames are reconstructed from arrays such as ["oob-worker.cf101-adf.worker","s.","de","v"].join("") and ['sdk.dl.','wel','1.ru'].join("") to evade static scanners. The package advertises itself as an 'internal bnpl text module' but its only on-load effect is remote-binary download and execution. ## Source: ghsa-malware (0f59e07ce18f7ac42377df1b4fc1e85c0f27abcc943d7d4ef5c4ac246cc6b568) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2) On require() of the package, index.js unconditionally loads _polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime by joining split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev). A fallback channel retrieves base64-encoded payload chunks over DNS TXT queries against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (c.<domain> for chunk count, N.<domain> for chunk data). The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn("/bin/sh",["-c", path+" &"],{detached:true}).unref() or spawn("cmd",...) on Windows. No hash or signature verification is performed. Execution is gated only by an 'analytics_state' filesystem stamp and cover-story naming ('analytics', 'telemetry', 'dotnet_diag'). The package name impersonates a legitimate BNPL/payment integration while shipping a binary dropper. ## Source: ghsa-malware (c0880c543b06fa184b4f5210c4dba55339f8c0bed3ab7ad2c2e7b6c51b0ff8c4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd) On require(), index.js loads _bootstrap.js, which reconstructs remote hosts by array.join string concatenation (oob-worker.cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev, with a *.dl.wel1.ru DNS-TXT fallback), downloads an opaque platform-specific binary over HTTPS (or via chunked base64 in DNS TXT records against c.<domain>/i.<domain> when HTTPS is unavailable), writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached and unref'd with stdio ignored via /bin/sh -c or cmd /c start. The package presents itself as a trivial BNPL container wrapper and ships no code related to that stated purpose; the fetched bytes are neither pinned nor hash-verified, the destinations are obfuscated to defeat static inspection, the DNS-TXT channel is designed to bypass HTTPS egress filtering, and the on-disk filenames impersonate legitimate diagnostic/cache artifacts. ## Source: ghsa-malware (f7a9336e6ce709efb3da35d383cf42ce65c1e5e998722cb7afda94304416a4d6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c) The package's index.js silently loads _loader.js via a swallowed try/catch (`try { require('./_loader'); } catch (_) {}`). _loader.js assembles one of three Cloudflare Workers hostnames via array-join string-splitting (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) and a DNS-TXT fallback under *.dl.wel1.ru, downloads a platform-specific binary, writes it to /tmp or %TEMP% under a disguised name (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. The exported class is a no-op shell; the package ships no functionality matching its advertised BNPL/React-component identity. Destination hostnames and the DNS-TXT covert channel (numbered TXT chunk reassembly of base64 payload) are obfuscated to evade static detection. ## Source: ghsa-malware (71d6c16c21d353e2ef00173287a0f98c84d1da2e0a3bcbc6a10ba6abe330e849) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (539999c456d5c8a3f5e2028b9bd7a0f8ca3ab41af3c67044ef7735e0c9f76845) On require, _polyfill.js selects a platform-specific payload, fetches an executable from one of three Cloudflare Workers hosts whose names are assembled at runtime from split string arrays to evade static matching (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched binary is written to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> on POSIX, dotnet_diag_<rnd>.exe on Windows), chmod 0755, and detach-spawned via /bin/sh -c or cmd.exe, with stderr suppressed. The package name is unrelated to the observed behavior; endpoint obfuscation, disguised filenames, opt-out env-var checks, and detached spawning are consistent with a stealth remote-code-execution dropper that runs on any host that installs and imports the package. ## Source: ghsa-malware (0753a74b489cf2420b83a3fac06d65e7939534b3c1861b16f98c42f90a93f0bf) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a) On require() of this package, index.js loads _bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that reassembles a base64-encoded payload from TXT records. The fetched bytes are written under /tmp or %TEMP% with a disguised filename (`.cache_<hex>` or `dotnet_diag_<hex>.exe`), chmodded 0755, and spawned detached via `/bin/sh -c` or `cmd.exe`. The C2 host strings and the `child_process` module name are split across array joins (`["oob-worker.cf103-070.wo","rk","ers",".de","v"].join("")`, `require("child_"+"process")`) to evade static matching. Cover-story identifiers (`analytics_state`, `DISABLE_TELEMETRY`) frame the drop as telemetry. A second, structurally identical dropper ships in lib/telemetry.js (~81 KB) dressed as an analytics SDK: dynamic `require("child_"+"process")`, base64 buffer reassembly, `chmodSync(..., 0o755)`, and `cp.spawn("/bin/sh", ["-c", filePath+" &"],...)`. ## Source: ghsa-malware (176764d97e59476107ea84a11437ba6719446a8f96682c7c6f46284e15f284a1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb) On require of the package, _helpers.js reassembles hostnames from split string arrays (e.g. 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev') and downloads a platform-specific native binary over HTTPS, with a DNS-TXT covert-channel fallback under *.dl.wel1.ru that base64-decodes concatenated TXT record chunks into the payload bytes. The downloaded binary is written to a temp path under a disguised name (dotnet_diag_<uid>.exe on Windows,.cache_<uid> on Unix), chmodded 0755, and spawned detached via spawn('/bin/sh','-c', filePath + ' &') or spawn('cmd',...). No hash or signature verification is performed and the delivery hosts are author-mutable. A second module, lib/telemetry.js, is bundled as a purported 'analytics' component and contains the same download-chmod-spawn shape (HTTPS transport, DNS service discovery, chmod 755 via string-concatenated 'chmod'+'Sync', spawn /bin/sh -c '<file> &'); it is not referenced from index.js in this version but ships in the tarball. Hostname string-splitting and the DNS-TXT fallback channel indicate deliberate evasion of static scanners and network filters. The package name and version metadata do not correspond to a documented native component that would justify runtime binary delivery. ## Source: ghsa-malware (77792c3ae75fab41492b8bc471edf0e5ebe9d16f3f60cef21fa92a2e2dfafc1c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766) Package advertised as an icon loader but on require() the bundled _vendor.js downloads a platform-specific executable from obfuscated Cloudflare workers.dev subdomains and *.dl.wel1.ru hosts (oob-worker.cf102-baf.workers.dev, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp or %TEMP% under disguising names (dotnet_diag_*.exe,.cache_*), chmods it 0o755, and spawns it detached via /bin/sh or cmd. Destination hostnames and the child_process require target are reconstructed at runtime via array.join("") splits to evade static scanners. If HTTPS mirrors fail, _vendor.js falls back to a DNS-TXT covert channel that queries c.<domain> for chunk count then N.<domain> for base64-encoded chunks, reassembles the executable, and feeds it to the same write/chmod/exec sink. Behavior does not match the package's declared purpose. ## Source: ghsa-malware (03baa2c099e2df5b44af4bdd58c79ed8cb97069284035967f7de9efaf1e30df1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11) Requiring the package loads _vendor.js, which reconstructs remote hosts from array-join fragments (resolving to Cloudflare Workers hosts such as oob-worker.cf*.workers.dev and a *.dl.wel1.ru fallback discovered via DNS-TXT), downloads a platform-specific binary over HTTPS with no hash or signature verification, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. A TTL stamp is used to avoid re-fetching on subsequent loads. The advertised purpose (a BNPL button UI set) has no legitimate need for downloading and executing an external binary, and the destination hosts are obfuscated to defeat static string scanning. ## Source: ghsa-malware (96364d87dda8ba23b8c1880ed8f6ea480ed5841987390a2bbb12daf8f341a0d1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc) On require of this package, index.js loads _bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembled Cloudflare Workers hosts (assembled from split fragments joined with.join('') to hide the destination, resolving to oob-worker.cf10x-*.workers.dev). The binary is written under /var/tmp or %TEMP% with disguised names such as dotnet_diag_<rand>.exe or.cache_<rand>, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A DNS-TXT fallback channel under *.dl.wel1.ru (resolver domains also assembled from split fragments) reads a count from c.<domain> TXT and iterates <n>.<domain> TXT records, base64-decoding the concatenation into an alternate payload delivery resilient to HTTP egress filtering. Destination hosts and resolver domains are obfuscated via string-split concatenation. ## Source: ghsa-malware (c59af5d56a9c3d1af7e4f4f942e01a23a353c1dd843393c7f3dd481cfe78aab0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241) On require(), index.js loads./_platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers subdomains (oob-worker.cf*-*.workers.dev), fetches an opaque platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c '<path> &' on Unix or cmd.exe /c start /b on Windows. A DNS TXT-record fallback (c.<domain> gives chunk count, N.<domain> gives base64 chunks reassembled from hosts like sdk.dl.wel1.ru) provides a covert retrieval channel when HTTPS is blocked. No hash or signature verification is performed; destination hosts are not associated with the package's publisher; hostnames are assembled at runtime specifically to defeat static analysis. Merely importing the package causes a remote binary to be executed on the installer's host. ## Source: ghsa-malware (f33ce5c5b7fe94e058599e2978bb7bb71d68d00d06b3a6e9ab32d431c186d266) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6) On require() of the package's main entry, _runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback resolving hosts under dl.wel1.ru (sdk./ext./pkg./net.), writes it to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c... & or cmd /c start. Hostnames are assembled at runtime from split-string arrays and child_process is loaded via a runtime require() inside _activate(), consistent with static-scanner evasion. Filenames masquerade as dotnet_diag /.cache and a TTL marker (analytics_state) rate-limits re-execution. Installing or requiring this package yields full-host code execution on the installer under attacker-controlled bytes. ## Source: ghsa-malware (20ea76efd9c7012010991937c1135b107f66754480f47907e869438deeee3bed) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.