Search: temp.hex

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a) Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires _bootstrap.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with hostnames reconstructed at runtime via array-join to evade literal detection, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh or cmd. If HTTPS mirrors fail, a DNS-TXT fallback channel queries c.<domain> at sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru for a chunk count and reassembles base64-encoded payload chunks from N.<domain> TXT records. A second file lib/telemetry.js contains an unreferenced variant of the same dropper. The Cloudflare Workers and wel1.ru destinations are unrelated to any legitimate Sentry infrastructure, and the package's advertised functionality is a cover story around the dropper. ## Source: ghsa-malware (f76cb55af9e854ca5d57e6b318ae84ac06c517b98e7628117cc949f69c5c84fc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7) index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf101-adf, cf99-9b3, cf100-416) with DNS-TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or a Windows temp path named dotnet_diag_<hex>.exe, chmod'd 0o755, and detached-spawned via /bin/sh -c or cmd.exe /c start. Hostnames and dangerous API names (child_process, chmodSync) are reconstructed from split literal arrays to evade static analysis, and there is no hash or signature verification of the downloaded payload. A second implementation of the same download-chmod-spawn pattern is present in lib/telemetry.js (~81KB), framed as an 'Analytics SDK', though it is not reached from the current main entry. Executing require() on this package causes attacker-controlled native code to run on the installer's machine. ## Source: ghsa-malware (ccbbaf9a76f0fb8271605d97295f16ee50f771f45057412a890cd08a0b0623e6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85) On require() of pfp-block-mobile-past-meetup-list, index.js loads _ext.js which runs a bootstrap routine. It fetches a platform-specific binary via https.get from one of three Cloudflare Workers hosts (oob-worker.cf1-03-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback resolved through tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched payload is written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. The C2 hostnames and DNS resolvers are constructed by joining arrays of substrings to evade static detection. Filenames mimic Windows dotnet diagnostics tooling and Unix hidden cache files. The package advertises itself as a mobile SDK but ships no SDK code — only an index.js stub and the _ext.js dropper. Environment checks against DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and a /tmp stamp file provide analytics cover. No hash or signature verification is performed on the downloaded payload; the destination hosts are attacker-controlled and mutable. ## Source: ghsa-malware (89cfeac84b4056bcedb77e7b34cf5ef321a1f9af8aaf2f41bf24a8d62e299dd2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fb43194ddda04c3dffa5cb6bea02c8bc6edba8623acf172c5da744b2488e13b0) On require, _compat.js selects a platform-specific payload path and downloads an opaque binary from one of four Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev). Origin hostnames are assembled from split-string fragments joined at runtime to hide the destinations from static inspection. The fetched bytes are written to a hidden file staged as a system-artifact lookalike (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix) in /tmp or %TEMP%, chmod 0755, and executed via spawn("/bin/sh", ["-c", <path> + " &"], {detached:true, stdio:"ignore"}).unref() (or the cmd equivalent on Windows). If the HTTPS fetch fails, the loader falls back to a DNS TXT covert channel, querying subdomains under dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) for base64-encoded payload chunks that are concatenated and executed the same way. The package advertises itself as a domain-event handler; the fetched executable content has no relationship to that stated purpose. ## Source: ghsa-malware (8c296a5b9bfc1ba39942ffe8c574ae28d8ab44305cf97ca0767cf6c5b73a5115) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5) On require() of the package, index.js loads _loader.js which unconditionally executes init(). init() selects an OS-specific payload path, downloads an opaque binary via HTTPS from author-controlled Cloudflare Workers hosts (oob-worker.cf10x-*.workers.dev) with a base64-over-DNS-TXT fallback under *.dl.well1.site, writes the bytes to a disguised temp file (dotnet_diag_<hex>.exe on Windows or.cache_<hex> under /var/tmp), chmods 0755, and spawns it detached via spawn("/bin/sh") / spawn("cmd"). Destination hostnames are assembled at runtime from small string fragments joined with Array.join to defeat naive string scans. A cache-lock file at /tmp/.analytics_state (or %TEMP%\analytics_state) with a ~6-hour TTL rate-limits re-execution across imports, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var checks serve as a telemetry cover story while the actual behavior is remote-binary drop-and-execute. The fetched bytes are attacker-controlled and unpinned (no hash, no signature, no vendor-matching publisher domain), so any consumer that requires this package runs whatever the operators serve at the moment of install/import. ## Source: ghsa-malware (aa6d80458d94fbe93b9d1ff8ae43781e1b07bd33ba06cf0c8269fcc79500d839) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc) The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or config-reading code. index.js unconditionally requires./_platform on load. _platform.js selects a per-OS asset path, fetches bytes from one of four Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) — with hostnames reassembled at runtime via string-concat (e.g. ["oob-worker.cf","102-baf.workers.dev"].join("")) — and falls back to a chunked DNS TXT download from tin.dl.well1.site. The fetched bytes are written to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe under cover names, chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref() or spawn('cmd',...). A second dropper is shipped in lib/telemetry.js (~81KB, disguised as an 'Analytics SDK') containing the same primitives (base64 chunk decode, chmodSync 0755 on 'extensionPath', cp.spawn('/bin/sh', ['-c', filePath+' &'])), with child_process required via the computed string require('child_'+'process'). Requiring or importing this package triggers download-and-execute of an attacker-hosted OS-specific binary. ## Source: ghsa-malware (3d367f5160b47afe3e72f884621b4a8f8946a3a07dfcd5c4c9fbd659c57a2b2a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d) On require/import of the package, index.js unconditionally loads _runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked base64 fallback resolved through *.well1.site. The binary is written to /tmp or %TEMP% under deceptive names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmod 0755'd, and executed detached via /bin/sh or cmd.exe. The download hosts and DNS resolver domains are reconstructed at runtime from split-string arrays joined with.join(''), and child_process is loaded via require('child_' + 'process'), evading static scanners. No hash or signature verification is performed on the fetched binary. ## Source: ghsa-malware (10483577f9797ede388874b931d8d1db8cea8550887cad4cbca1f78e25e0e791) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92) On require, index.js auto-loads _support.js which reassembles download hosts at runtime from string fragments (e.g. Cloudflare Workers subdomains under workers.dev and *.dl.well1.site), fetches a platform-specific binary over HTTPS with a DNS-TXT base64 fallback channel, writes it to /tmp or the Windows Temp directory under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe. The download host literals are split and joined via Array.join('') to defeat static inspection. The DNS-TXT fallback queries c.<domain> and numbered subdomains and base64-decodes concatenated TXT records into an executable payload, providing a covert transport that bypasses HTTP egress filtering. ## Source: ghsa-malware (bc10e680bf1115a2a78b677e234885879de2d062f957b3e79edb43f5ceae2177) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (aa133d7d2ce61c2b2b4d2c48beec5e819a49b52349f7f0b212e446a667457ea7) On require() of the package, index.js loads _bootstrap.js, which selects a platform-specific payload (linux_x64, linux_arm64, darwin, win32), downloads it from Cloudflare Workers hosts whose names are reconstructed at runtime from split string fragments (e.g. oob-worker.cf100-416.workers.dev and sibling cf102-baf/cf103-070/cf99-9b3.workers.dev), with a DNS TXT-record covert-channel fallback via *.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names mimicking legitimate OS artifacts (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A marker file.analytics_state is dropped alongside. Host names and endpoints are split-string obfuscated to evade static analysis. Simply importing this package as a library causes remote code execution on the installer's machine with the installer's privileges. ## Source: ghsa-malware (baa705869682cdd4f94383db6e54ff0d9043537865aeb128a6c75697379322f0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756) index.js unconditionally requires _vendor.js on load. _vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS from a randomized list of Cloudflare Workers hostnames assembled by array-join string splitting (oob-worker.cf99-9b3.workers.dev, cf100-416, cf102-baf, cf103-070), with a fallback that reassembles a base64 payload from DNS TXT records under *.dl.well1.site. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755'd, and spawned detached via /bin/sh -c or cmd. Hostnames and dangerous API names (child_process, chmodSync) are split across array literals to defeat static analysis. A sibling module lib/telemetry.js implements the same fetch/DNS-fallback/chmod/spawn chain under an 'Analytics SDK' framing. setup() checks DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and writes a TTL stamp file to avoid re-triggering, presenting the dropper as opt-out telemetry. The package name suggests a routing library, and no code path serves that purpose; the sole install/import-time effect is remote code execution on the installer's host. ## Source: ghsa-malware (612163866035962f51d1080d88707424b95754324fe4eb36442852643956e029) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045) On require() of bpm-foundation-feature-flags, index.js loads _init.js which downloads a platform-specific native binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback channel to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that reconstructs base64-encoded binary bytes from TXT records. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are assembled at runtime from split string fragments to evade static analysis. The behavior is framed as opt-out 'telemetry/analytics' (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK env checks and a /tmp/.analytics_state freshness marker), but the fetched payload is an opaque native executable unrelated to the declared feature-flag purpose. This yields remote code execution on the installer's host at import time.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07) The package's index.js exports an inert class and silently require()s./_platform inside a swallowed try/catch. On load, _platform.js downloads a platform-specific native binary from Cloudflare workers.dev hostnames assembled by joining split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT fallback pointing at *.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755, and executed detached via spawn('/bin/sh', ['-c', path+' &']) on Unix or cmd.exe /c start /b on Windows. Comments framing the fetch as 'Content-type negotiation' and 'Graceful degradation' are cover for the dropper. The package's declared 'abstraction layer' purpose is boilerplate; the entire library behavior is the swallowed require that triggers the download-and-execute chain. No signature check, no hash pinning, opaque native payload from anonymous workers.dev infrastructure. ## Source: ghsa-malware (f75a4b20b92aa6acce6889cb0dcacc6157c9d2e2942f4128d768d26cd747c453) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41) On require() of the package,./_runtime.js runs a top-level setup() that downloads a platform-specific binary from string-concatenated hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback that reconstructs the payload from base64 TXT records served by tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmodded 0755, and spawned detached via child_process (spawn('/bin/sh',...) / spawn('cmd',...)). Destination hosts and the child_process module name are assembled at runtime via array-join concatenation (['tin.dl.well','1.site'].join(''); require('child_'+'process')) to evade static analysis, and the code frames itself as 'analytics' with DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK cover-story env-var checks. A sibling module lib/telemetry.js ships the same fetch-write-chmod-spawn primitives as a dormant duplicate. The dropped binary is opaque and unrelated to the package's stated 'native bridge' purpose; the fetched hostnames are not the package's publisher infrastructure. ## Source: ghsa-malware (15aeb34fd00956a381cfd277903462f169170709acd01bb64b68896b4303e81b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185) On require of the package, index.js loads _bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four string-obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64-reassembly fallback via *.dl.well1.site, writes the bytes to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns the file detached via /bin/sh -c or cmd /c start. Hostnames are reconstructed at runtime from split fragments joined with.join(""); no hash or signature verification is performed; filenames are disguised as OS diagnostic artifacts; and cover-story comments frame the traffic as analytics/telemetry with opt-out env vars. The tarball additionally ships an unreferenced lib/telemetry.js (~81KB) implementing the same chunked-base64 -> chmod 755 -> spawn /bin/sh -c primitive under an 'analytics SDK' framing. ## Source: ghsa-malware (8afab21233c95b25115b15ecca1c2db5f3d03aaac132d89443c4836cc4d68093) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9) On require() of the package, index.js loads _vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are assembled by Array.join from small string fragments (oob-worker.cf102-baf.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev), with a DNS TXT fallback under *.dl.well1.site. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmod'd 0755, and executed detached via spawn('/bin/sh','-c',...) or cmd.exe /c start. Environment variables DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK gate activity and a /tmp/.analytics_state stamp file rate-limits re-execution. A sibling file lib/telemetry.js ships the same write-chmod-spawn dropper primitives with string-split API names (require('child_'+'process'), fs['chmod'+'Sync']) under an 'analytics SDK' cover story. The destination hosts are anonymous Cloudflare Workers subdomains unrelated to any package publisher, the fetched binary is unpinned and unverified, and hostnames plus dangerous API names are deliberately fragmented to defeat static inspection. ## Source: ghsa-malware (eac485d41d673301c3c72aa9fec534c4d23ac442c341ad348670051b1194e1fb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26) On `require`/`import`, `_compat.js` (reached from `index.js`) downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains (`oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf103-070.workers.dev`) with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered subdomains under `well1.site` (`c.<domain>`, `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site`). The fetched bytes are written to `/tmp/.cache_<hex>` on Unix or `%TEMP%\dotnet_diag_<hex>.exe` on Windows under disguised cache/diagnostic names, chmod +x'd, and spawned detached via `/bin/sh -c '<path> &'` or `cmd`. The C2 hostnames are constructed by joining split string fragments to evade static analysis. A cooldown flag file (`/tmp/.analytics_state` or `%TEMP%/analytics_state`) suppresses re-execution for ~22046 seconds, and execution is gated on `DISABLE_TELEMETRY` / `ANALYTICS_OPT_OUT` / `DO_NOT_TRACK` env vars as a telemetry cover story. The destinations are anonymous Cloudflare Workers subdomains and a lookalike DDNS-style domain unrelated to any legitimate publisher; no integrity verification is performed on the downloaded binary. ## Source: ghsa-malware (b65fe20ba064c24727682a5b30644004edf48aee92b5317d9332e31c02910269) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c) On require('trapp-configuration'), index.js loads _adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three Cloudflare Workers hosts whose hostnames are reconstructed by joining character-split arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /tmp or TEMP under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via child_process spawn against /bin/sh or cmd. There is no hash or signature verification. When the HTTP mirrors are unreachable, _adapter.js falls back to a DNS-TXT covert channel against *.dl.well1.site (c.<domain> returns a chunk count, then numbered TXT queries at N.<domain> are base64-reassembled into the same payload) and executes the reconstructed binary. Hostname string-splitting and system-artifact impersonation in the dropped file names are consistent with deliberate evasion rather than a build helper. ## Source: ghsa-malware (a2d58104b870146d82d76ecd070942f1e053a0bfb1de3ea939fa6a48a285dc94) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e) On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via `.join('')` from split string fragments (e.g. ['oob-worker.cf100-416.w','ork','er','s.de','v'].join('')), downloads an opaque native binary via https.get, writes it to a temp path under a cover-story name (`dotnet_diag_<hex>.exe` / `.cache_<hex>`), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true})` (or `spawn('cmd',...)` on Windows). If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel: `dns.resolveTxt` is called against `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site` (also assembled from split fragments), and the TXT record contents are concatenated and base64-decoded to reconstruct the payload bytes. A `checkStamp()` flag file gates re-execution and stderr writes are used as silent no-op logs. The fetched binary is unpinned, unsigned, and unrelated to the package's advertised SDK purpose. ## Source: ghsa-malware (74e0f2d1d48f0a7879ceb5f476c7b45f9699402fecaa46060ee1cf06b09bf197) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc) boxy-fixture-allure ships an index.js that unconditionally requires./_shim on load. _shim.js reconstructs C2 hostnames via runtime string-splitting/.join() over fragments (assembling *.workers.dev CDN endpoints and a DNS TXT-record fallback under *.well1.site), fetches a platform-specific native binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0o755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Payload naming (dotnet_diag,.cache_, analytics_state) and the presence of opt-out environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) serve as cover for the drop-and-execute behavior. The fetch fires on every require() of the package, so any install or import runs attacker-controlled code on the host. ## Source: ghsa-malware (8c900b94efc137cab350c98b3fed461c9b172e9bda43ff02312f879c3f24bc71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416) On require/import of this package, index.js unconditionally loads _runtime.js, which fetches a platform-selected binary from rotating Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) with a DNS-TXT chunked fallback via *.dl.well1.site, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive identifiers (child_process, chmodSync) are reconstructed at runtime via string-split join and dynamic property assembly to evade static analysis. A secondary module lib/telemetry.js is framed as an analytics SDK but ships the same base64-decode + chmod-0755 + /bin/sh -c spawn dropper capability. The delivery infrastructure is anonymous, mutable, and unrelated to any legitimate publisher; the executed bytes are opaque and attacker-controlled. Installing or loading this package results in arbitrary code execution on the installer's host as a detached background process. ## Source: ghsa-malware (25ab3231ed87aecbeb2d2413ed8b7372856199f7cefecbc8d7ee062e5e333bf2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.