Search: df.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945) On require of the package, _runtime.js selects an OS/arch-specific payload (linux_x64, linux_arm64, darwin, win32), downloads a binary from string-split-obfuscated *.workers.dev mirrors (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT-record fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that base64-decodes assembled chunks, writes the bytes to /tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe /c start. Host strings are assembled via array.join() to evade static analysis, and cover-story naming ('.analytics_state', 'dotnet_diag_', 'telemetry' comments) is layered over the dropper. The declared purpose of the package (a BNPL payment popup) does not require importing or executing a fetched native binary. ## Source: ghsa-malware (cf143f6664d3a792cef531065788e7a5792d2f9e0c63a80ad0c97b6804ffba40) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (95d52abe2ced4314ede2df4d3475d73fb87f52298434cdbf6469bf057613346f) index.js unconditionally requires./_init at module load time. _init.js selects a platform-specific path, fetches an opaque native binary over HTTPS from a rotating set of Cloudflare Workers subdomains whose hostnames are assembled at runtime via array.join("") to evade plain-text scanning (e.g. oob-worker.cf99-9b3.workers.dev, cf101-adf/cf103-070/cf100-416.workers.dev), writes it to /tmp or %TEMP% under a disguised name, chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A fallback covert channel queries TXT records at c.<domain> and N.<domain> under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenates the chunks and base64-decodes them into the same executable payload. Requiring or installing the package results in execution of attacker-controlled native code on the installer host. ## Source: ghsa-malware (14cb62d811a687032f1374c803415b84f5bba3715c074381da656dda3e4ce1b0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54) Requiring dolyame-boxy-desktop-bnpl-footer causes _platform.js to execute at load time: it reconstructs destination hostnames from split string arrays (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows (masquerading as a.NET diagnostic file), chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. If HTTPS delivery fails, dnsChunked() falls back to a DNS-TXT covert channel under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru), resolving c.<domain> for a chunk count and reassembling base64 TXT records into the executable. Destinations and dangerous APIs are obfuscated via Array.join('') and dynamic property lookups (require('child_'+'process'), fs['chmod'+'Sync']). A second copy of the same dropper is bundled in lib/telemetry.js behind an 'Analytics SDK' cover story. No hash or signature verification is performed on the fetched binary. ## Source: ghsa-malware (ed53f94a9d9ca52e9bddfc8c9890a6a6e474f6eae42ec55c4557ba1876ea4aa5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee) The package `main` (`index.js`) requires `./_init` on load. `_init.js` assembles hostnames via string-split `.join('')` obfuscation to produce a rotating list of Cloudflare Workers endpoints (`oob-worker.cf103-070.workers.dev`, `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`) plus a DNS-TXT covert-channel fallback via `*.dl.wel1.ru` (`sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, `net.dl.wel1.ru`). It downloads a platform-specific binary, writes it to `/var/tmp` or `%TEMP%` under disguised names (`dotnet_diag_<rand>.exe`, `.cache_<rand>`), sets mode 0755 on POSIX, and spawns it detached via `/bin/sh -c... &` or `cmd /c start /b`. Environment flags such as `DISABLE_TELEMETRY`, `ANALYTICS_OPT_OUT`, and `DO_NOT_TRACK` act as kill switches. A second dropper is bundled in `lib/telemetry.js` (81 KB), which reconstructs a payload from base64-encoded DNS TXT chunks and executes it using the same detached-shell pattern, hidden behind `require('child_'+'process')`, `fs['chmod'+'Sync']`, and an `analytics-sdk` cover story. The package's advertised purpose has no relationship to any such native runtime. ## Source: ghsa-malware (2c6b20a72d52db6e703edf3d70652989c61e881ea98641fcdbfd73847d7452a5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3) On require() of dolyame-boxy-fonts, index.js unconditionally loads./_loader.js, which reconstructs C2 hostnames from split-string arrays (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and a DNS-TXT fallback channel under *.dl.wel1.ru (chunk-count via c.<domain>, base64 chunks via N.<domain> retrieved through dns.resolveTxt). _loader.js downloads a platform-specific binary, writes it to /tmp or %TEMP% under a hidden/decoy name (.cache_<rand> or dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. The fetched bytes are opaque, unpinned, and not hash-verified, and the destination hosts are anonymous Cloudflare Workers subdomains assembled at runtime to defeat static grep. A sibling module lib/telemetry.js ships in the tarball with the same dropper primitives (require('child_' + 'process') string-split, fs['chmod' + 'Sync'], cp.spawn('/bin/sh', ['-c', filePath + ' &'])), providing an alternate execution path. Installing or requiring this package causes attacker-controlled code to execute on the installer's machine. ## Source: ghsa-malware (8fc78c53700a2acd4b24e0604a5f8b99e8e425b04b17a32aae2ed79ae8422be9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2) On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT covert-channel fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The payload is written to /tmp or %TEMP% under a disguised name (dotnet_diag_<uid>.exe on Windows,.cache_<uid> on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification, hostnames are assembled from array fragments joined at runtime, and the download destinations are unrelated to the package's stated BNPL-cards purpose. A lockfile named.analytics_state and opt-out env vars named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are used as a telemetry cover story. ## Source: ghsa-malware (52dea7d898c8f1e0fa0c6af08e0ada75adc49dfbfc69a89ba5068f4bd9a7b5af) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a) index.js require()s _platform.js on load, which reconstructs hostnames from split string arrays (oob-worker.cf10*-*.workers.dev and sdk.dl.wel1.ru) to hide destinations from static inspection, then HTTPS-fetches an opaque binary payload from those hosts with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a randomized hidden filename (.cache_<rand> / dotnet_diag_<rand>.exe), chmod 0755, then spawned detached via /bin/sh -c or cmd.exe (_platform.js line 119-125). No hash or signature verification is performed, and the fetched payload is unrelated to the package's advertised BNPL container purpose. A.analytics_state marker file and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-out flags provide cover-story framing over the loader. The dropper fires at module require time. ## Source: ghsa-malware (ae1645a20f33890b6484de65fd02e51744251f379954bf7a61caa228be7fcc44) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a) On require(), _bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-transfer fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. Host names and resolver domains are assembled from split string fragments (e.g. ['oob-worker.cf100-416.worke','rs.dev'].join('')) to defeat static analysis. A flag file named /tmp/.analytics_state is used as a run stamp, but the package ships no analytics functionality — the name is cover. Execution is guarded only by opt-out env vars, so a default install-and-require chain runs the attacker-controlled binary with the invoking user's privileges. ## Source: ghsa-malware (124a13dcdb80c3bd90e3029669fb50c0ee496ede277e0a8ac1be8f8efe1a3f7e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b31579fb9a360c4781524c5edd9d0e7b84440e7ccd073e09d54afc10678764cf) On require() of this package, index.js loads _compat.js which unconditionally downloads an OS-specific binary from Cloudflare Workers hosts assembled at runtime via string-array join (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev), with a DNS-TXT chunked fallback served under *.dl.wel1.ru (sdk.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under cover-story filenames (analytics_state, dotnet_diag_*.exe,.cache_*), chmod 0755 on POSIX, then spawned detached and unref'd via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification, no relationship to any legitimate publisher, and the hostnames and the child_process require are obfuscated via array.join to defeat static analysis. Package name impersonates a Dolyame BNPL integration but ships no such functionality. ## Source: ghsa-malware (abfed9e023b5c6d17fc35410b41929bf6d447e802a33a2bcb83cb7fd483d8626) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9) On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g. "oob-worker.cf99-9b3.worker" + "s.dev"), downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev) with a DNS-TXT covert-channel fallback (base64 chunks reassembled from resolveTxt of numeric subdomains under dl.wel1.ru), writes the payload to a disguised path under /tmp or %TEMP% (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755 on Unix, and spawns it detached via /bin/sh or cmd.exe. A state file throttles re-runs. Package name resembles a legitimate BNPL/payment integration but the shipped code implements a remote-payload dropper with no relation to that stated purpose. ## Source: ghsa-malware (5d31c7a4f92cc32521ef343a86ff4d50644dd80a95c698b2b370a68e4e767219) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae) On require() of the package, index.js loads _ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (c.<domain> for chunk count, i.<domain> for base64-reassembled payload chunks across sdk/ext/pkg/net subdomains). The fetched bytes are written to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe /.cache_<hex>), chmod 755'd, and spawned detached via /bin/sh -c or cmd /c start. Destination hostnames are reconstructed via array-join to evade static string scanning. The behavior is framed as opt-out telemetry (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks,.analytics_state file), and lib/telemetry.js contains a parallel Buffer.from(chunks,'base64') + fs.chmodSync + cp.spawn('/bin/sh',['-c', filePath+' &']) code path that corroborates the write-chmod-exec pattern. ## Source: ghsa-malware (f19d34835a9a9239da98c35195bbeefb0f0b5f67e698897c2730cdf4b8262b90) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681) On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked base64 fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under deceptive names such as dotnet_diag_*.exe and.cache_*, chmod 0755 on POSIX, then spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A second ~81 KB module at lib/telemetry.js, framed as an 'Analytics SDK', reimplements the same fetch/write/chmod/spawn chain and DNS-TXT reassembly as a redundant dropper. Hostnames and sensitive API identifiers ('child_process', 'chmodSync', 'workers.dev', 'dl.wel1.ru') are reconstructed at runtime via Array.join and bracket-property concatenation to evade static analysis. Opt-out environment variables and a TTL lock file are present as cover-story hygiene but do not constitute consent. ## Source: ghsa-malware (36e37533131ea5ce9d4a73dfa8680516c916abc9b3eb719a4678fdb8cd8f1f31) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310) On require of the package, index.js unconditionally loads _bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked fallback that reassembles base64 content across numbered subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmod 0755 on POSIX, and executed detached via spawn("/bin/sh",...) or spawn("cmd",...). Destination hostnames are assembled from fragmented arrays joined at runtime to evade static analysis; the file is staged under masquerading names (dotnet_diag_,.cache_) and gated behind DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK cover-story environment variables. The package's advertised purpose (a picture-gallery / BNPL support module) has no legitimate need to download and execute a native binary from anonymous edge-worker hosts with no version pinning, no publisher-controlled origin, and no hash or signature verification. ## Source: ghsa-malware (93b7d20b5c9d5f24d8d4b343681dbe0e37ec95816667d008a60fe956e8714e66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231) index.js unconditionally requires./_loader on load. _loader.js selects a platform-specific payload path (linux_x64, linux_arm64, darwin, win32) and downloads a binary from Cloudflare Workers hostnames assembled at runtime by joining split string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", path + " &"]) or spawn("cmd.exe", ["/c", "start", "/b", path]). A sibling lib/telemetry.js wraps the same primitives (require("child_" + "process"), fs["chmod" + "Sync"], base64 chunk decode, spawn of /bin/sh and cmd.exe) inside Sentry-mimicking scaffolding as an alternate loader. No hash, signature, or publisher verification is performed on the fetched payload. The typosquat-style package name, split-string hostname reassembly, cover-story filenames (.cache_, dotnet_diag_), and detached/unref'd execution are consistent with a purpose-built import-time dropper. ## Source: ghsa-malware (9798a6a34ba04688210f68cbf4582d669ef1a91abeeb44a27ffd05c73921240c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698) index.js unconditionally requires./_bridge on load. _bridge.js selects a per-platform payload (linux x64/arm64, darwin, win32), fetches a native binary over HTTPS from a hardcoded list of Cloudflare *.workers.dev endpoints (assembled at runtime by joining split string arrays such as ["oob-worker.cf101-adf.work","ers",".de","v"]), writes it to /tmp/.cache_<uid> or %TEMP%/dotnet_diag_<uid>.exe under names that impersonate benign artifacts, chmods 0755 on POSIX via fs["chmod"+"Sync"], and spawns it detached through /bin/sh -c on POSIX or cmd.exe /c start /b on Windows. A DNS TXT covert-channel fallback resolves alternate payload sources under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, with the discovery domains also reconstructed from split arrays. lib/telemetry.js ships a second parallel dropper implementation labelled as an "Analytics SDK" (base64 payload assembly, chmodSync 0755, /bin/sh -c spawn) that is not reached from the current index.js but is packaged in the tarball. The advertised purpose (a BNPL banner abstraction) has no relationship to fetching and executing platform-specific native executables, and the destinations are not publisher-owned. ## Source: ghsa-malware (136bb556f5d69b483536f852deeebae245dcd87809dd2dd7e39f1909acabefae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (31565660321da87adf5d579f4608cd6059c88afd2c95a04eb7223031881572f7) The package's top-level index.js unconditionally requires./_platform on load. _platform.js reconstructs a set of mirror hostnames via string-split concatenation (oob-worker.cf101-adf.workers.dev family) and a DNS-TXT discovery fallback under *.dl.wel1.ru, selects a per-architecture endpoint from an internal _BIN_MAP, fetches an opaque binary over HTTPS, writes it to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe under a cover filename, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. lib/telemetry.js ships the same fetch-decode-write-chmod-spawn primitive framed as an 'analytics SDK', with require("child_"+"process"), Buffer.from(chunks,"base64") decoding, fs["chmod"+"Sync"](...,0o755), and cp.spawn("/bin/sh",["-c",filePath+" &"]). Hostnames, discovery domains, and the child_process module name are assembled from split fragments to evade static analysis. The fetched payload does not match the package's stated purpose (a BNPL mobile SDK), the destinations are author-controlled and obfuscated, and execution fires at require-time with only TTL cache and opt-out env-var guards. ## Source: ghsa-malware (396c85bd51889c7c46eeeab08db2ab12eae0ab199a620dae44def63226897189) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437) On require, index.js loads _init.js which reconstructs hostnames from split-string arrays (e.g. ['oob-worker.cf102','-baf.workers.','dev'].join('') and ['sdk.dl.','wel1.ru'].join('')) to build URLs against four Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific binary is downloaded via https.get, written to /tmp or %TEMP% under disguised names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmodded 0755, and launched detached via spawn('/bin/sh', ['-c', path+' &']) or spawn('cmd',...). The fetched payload is unverified, comes from mutable non-publisher hosts, and executes on module load rather than through any documented API of the package. ## Source: ghsa-malware (7cd7386bf67dcd89be60f275d29aa374bf07fa12a56f1ff56bef400c7b2ddf17) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c) On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts (with a DNS TXT fallback via sdk.dl.wel1.ru), writes it to /var/tmp or %TEMP% under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed from array-joined string fragments (e.g. ['oob-worker','.cf10','1-adf.w','ork','ers.d','ev'].join('')) and require is split as require('child_'+'process') to evade static scanners. Execution is gated by a lockfile cooldown to run once per host. The package name impersonates the Dolyame BNPL brand; the shipped code is a generic remote-binary dropper unrelated to any BNPL functionality, granting the operator of the Workers hosts arbitrary code execution on any machine that installs or imports this package. ## Source: ghsa-malware (77a936690ebd1b36e35495e4a0b18b8913b0a8ff9c45348179943b52974eeb76) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae) The package presents itself as a UI dropdown library but on require executes _init.js, which selects a platform-specific asset (linux/darwin/win32), fetches an opaque binary over HTTPS from string-fragmented `*.workers.dev` hosts (assembled via `.join('')` to hide the hostname from static scanners) with a DNS-TXT chunked-base64 fallback to `*.dl.wel1.ru`, writes the payload to /var/tmp or %TEMP% under a disguised name (`dotnet_diag_<hex>.exe` on Windows, `.cache_<hex>` on Unix), chmods it 0755, and spawns it detached via `/bin/sh -c "<file> &"` or `cmd.exe /c start /b`. The `require("child_"+"process")` split, the fragmented CDN host arrays, the.NET-diagnostics filename masquerade, and an `analytics_state` marker file provide cover-story framing. There is no pinning, hash verification, publisher-matched origin, or relation to a UI dropdown component. Installing or importing the package results in arbitrary attacker-controlled code executing on the installer's host. ## Source: ghsa-malware (5aa96551428ffa96321135f6a2df75bfddc6d1a28627a94dc3d689940e13e377) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061) The package's main entry (index.js) unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from a rotating list of Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) whose hostnames are assembled via array-join string splitting to evade static analysis, with a DNS-TXT chunked fallback across sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path under a disguised name ('dotnet_diag_<tag>.exe' on Windows or '.cache_<tag>' on POSIX), chmod 0755, and spawned detached via cmd.exe /c start /b or /bin/sh -c "fp &". There is no hash or signature verification of the downloaded payload; the source hosts are attacker-controlled infrastructure unrelated to the package's stated Vite-plugin purpose. Execution is suppressed by DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables and cached via a marker file with a ~21329s TTL, framing the behavior as telemetry while dropping and running an opaque binary. Any consumer that requires or imports this package triggers full-host code execution under attacker control. ## Source: ghsa-malware (8c85582964f88194107914cd82214c07879ac0ae310f6fd7af6c885b30145a71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.