Search: df.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07) The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires _support.js, which fetches and executes an attacker-controlled binary on load. Hostnames are assembled at runtime from split character arrays to evade static analysis: HTTPS mirrors resolve to oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, and oob-worker.cf103-070.workers.dev on Cloudflare Workers, with a DNS-TXT chunked fallback against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (a count is read from c.<domain>, then N base64 TXT chunks are reassembled into an executable). The downloaded payload is written to a temp path with a randomized name, chmodded 0755, and spawned detached via `spawn('/bin/sh', ['-c', fp+' &'])` on Unix or `cmd.exe /c start /b fp` on Windows. Comments and identifiers ('analytics_state', 'dotnet_diag_', 'telemetry', 'Cross-platform path resolution') act as cover for the loader. The dropper has no relation to the package's stated purpose, and no integrity check, pinning, or publisher-controlled source is present. ## Source: ghsa-malware (fbd835a40a29c30efae55e501f7cd7996179a8f41f2ec1ed67560580bc67a4a3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4) Package is published as an i18n library but its main entry (index.js) requires./setup on load. setup.js selects a per-platform payload path, fetches bytes over HTTPS from mirror hosts assembled at runtime via array-join (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT chunked base64 fallback via subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c '<path> &' or cmd /c start. A stamp file rate-limits re-execution. A parallel loader in lib/telemetry.js reconstructs a base64 payload from DNS TXT chunks and executes it through the same write+chmod+spawn chain; dangerous API references are hidden via string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]). Destination hosts, module names, and filesystem APIs are all obfuscated via array-join and string concatenation, and the dropped filenames mimic OS cache/diagnostic files. ## Source: ghsa-malware (2a340322be600687a0c7f8d2a109863bf8544e0a8637184db038b9ff8861810e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9) The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes `try { require('./_bootstrap'); } catch (_) {}` on module load, hiding the malicious side effect behind a swallowed exception. _bootstrap.js selects a platform-specific payload path, downloads bytes from one of three hardcoded Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru — writes the payload to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via `/bin/sh -c "<path> &"` or `cmd /c start`. Destination hostnames are reconstructed at runtime by array-joining split literals to evade static inspection, and cache/payload filenames (`analytics_state`, `dotnet_diag_<hex>.exe`) are chosen to blend in with legitimate telemetry artifacts. An 80KB lib/telemetry.js is shipped but never referenced from index.js, consistent with cover-story padding. Requiring or installing this package causes attacker-controlled native code to execute on the developer's host. ## Source: ghsa-malware (d662b5ea3e0d9ad955f194ab74515a958541234a800ca195728a1b464ce67ee7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197) devplatform-humanize-network-error@35.3.8 advertises itself as a network-error humanizing utility, but on `require()` its index.js unconditionally loads _adapter.js, which fetches a platform-specific native binary over HTTPS from Cloudflare Workers hosts assembled at runtime from string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe`. No hash or signature verification is performed and the payload is unrelated to the package's stated purpose. If the HTTPS fetch returns less than 1000 bytes, a fallback DNS-TXT covert channel reassembles a base64-encoded payload from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (queried as c.<domain> plus per-index sub-labels) and executes it identically. Destination hostnames are reconstructed from `.join("")` fragments and dropped artifacts are named to masquerade as telemetry/diagnostic files (.analytics_state,.cache_<hex>, dotnet_diag_<hex>.exe), with comments framing the drop as analytics. A sibling lib/telemetry.js (~80 KB) shipped in the same tarball replicates the same HTTPS+DNS discovery, detached shell spawn, chmod 0755, and base64 chunk reassembly primitives but is not currently referenced by the entry graph. ## Source: ghsa-malware (47de4c5b573787f054f5da4dcda55c344af9a2d51c72763129ecfb5f66570fd6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf) The package presents itself as an Nx stylelint helper but its main entry require()s _platform.js, which on load downloads a platform-specific executable from one of four Cloudflare Workers hosts whose names are assembled at runtime via array-join concatenation (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev). If HTTPS retrieval fails, it reassembles the payload from base64 chunks served in DNS TXT records under sdk/ext/pkg/net.dl.wel1.ru (reading a chunk count from c.<domain> and concatenating parts from <i>.<domain>). The bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and launched detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true, stdio:"ignore"}).unref(). A marker file.analytics_state suppresses re-execution. lib/telemetry.js embeds a second copy of the same dropper (base64 chunk decoding, split "chmod"+"Sync" and cp.spawn("/bin/sh",...)) under an analytics-SDK cover story. The exported DevplatformNxStylelint class is a no-op stub; the package's only functional behavior is the dropper. Package naming impersonates the Nx stylelint ecosystem. ## Source: ghsa-malware (17bb3474e482e10720577233ded6d0d01962b5055551dfdb0a98507d09b23d9e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3270e0e94deb3e2573594f28e84026653ee60f6c7f0a1fb79286ebba811ca525) On require, index.js unconditionally loads _init.js, which selects a platform-specific binary for linux/darwin/win32, downloads it from Cloudflare Workers hosts whose names are assembled by splitting and joining string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback under sdk/ext/pkg/net subdomains of dl.wel1.ru, writes the bytes to /tmp or %TEMP% under disguised names such as dotnet_diag_*.exe and.cache_*, chmods 0755, and detach-spawns the file via cp.spawn("/bin/sh", ["-c", path + " &"], {detached:true}) or cmd.exe /c start /b. No hash or signature verification is performed and the destinations are not documented publisher infrastructure. child_process is obtained via require("child_" + "process") to evade static matching. lib/telemetry.js ships an 81 KB second loader that reproduces the same fetch, base64-decode, chmod 0755, and /bin/sh -c spawn chain. The package's declared purpose (PO declaration generator) does not require fetching and executing native binaries from anonymous Cloudflare Workers hosts. ## Source: ghsa-malware (0a16595ba151c2cc5e13ed55ecd21e30ac2aab5a1723f476d76f0a2547ee0ac3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca) On require(), index.js loads _loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) whose hostnames are reconstructed at runtime by joining split string arrays. The retrieved payload is written to /tmp or %TEMP% under disguised names such as dotnet_diag_*.exe or.cache_*, chmod'd 0755, and spawned detached via spawn('/bin/sh', ['-c', path+' &']) or spawn('cmd',...). No hash or signature verification is performed, and the destinations are not the publisher's infrastructure. A DNS-TXT covert-channel fallback under *.dl.wel1.ru (also assembled from split strings) delivers a base64-chunked payload when HTTPS fetch fails. The combination of split-string hostname reconstruction, non-publisher mutable delivery hosts, no integrity verification, disguised drop filenames, detached shell execution on require, and DNS-TXT delivery fallback constitutes an install/import-time dropper that executes attacker-controlled code on the installer's machine. ## Source: ghsa-malware (c92e357a35ed92ebf896cd667257f562f9e2e1630923160a6a0779adf59c7a4b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475) devplatform-react-micro-frontend@35.2.1 is a lure package whose main entry auto-loads _adapter.js on require. _adapter.js selects a platform-specific asset, downloads an opaque binary over HTTPS from a rotating list of Cloudflare *.workers.dev hosts (oob-worker.cf101-adf.workers.dev and siblings cf100/cf102/cf103), and if HTTPS fails reassembles up to 2000 numbered TXT records under *.dl.wel1.ru into a base64 payload. The bytes are written to a temp path under a masquerading name (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 755 on POSIX, and spawned detached via /bin/sh -c or cmd. Network destinations are assembled by joining substring arrays (e.g. ["oob-worker.cf101-a","df.workers.","dev"].join(""), ['sdk.dl.w','el1.','ru'].join("")) to evade static analysis. A duplicate dropper is shipped as lib/telemetry.js framed as an "Analytics SDK", using string-concat obfuscation of require("child_"+"process") and fs["chmod"+"Sync"] to reach the same write-chmod-spawn sink. Installing or requiring the package results in remote-controlled binary execution on the host. ## Source: ghsa-malware (c0cc6b5c52ea4bfa63cba8d1ccf60738a476118b01aff6c0b421c548a67f47f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (755ebe99a58cc94ddd8953897d01f30fcbacd145f6acf635761cf08b33d4868c) On require of this package, index.js loads _ext.js, which fetches a platform-specific binary from a rotating list of Cloudflare workers.dev hosts assembled at runtime via array.join to defeat static string scanning (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback channel via *.dl.wel1.ru (sdk, ext, pkg, net). The fetched binary is written to /tmp or %TEMP% under a cover-story name impersonating.NET diagnostics tooling (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe. Any consumer that requires the package on install/import receives arbitrary attacker-controlled code execution on the host. ## Source: ghsa-malware (26008a5d95840ff404c5a75362ed3d81eedbd8989fcd37a6c40441421a96dc29) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6) On require('devplatform-react-form'), index.js loads _adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to /tmp or %TEMP% under deceptive names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0o755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true, stdio:'ignore'}).unref(), using a stamp file to avoid re-execution. Host and API strings are assembled from split fragments (e.g. ["oob-worker.cf102-baf.wo","rk","ers.de","v"].join(""), require('child_'+'process')) to evade static analysis. lib/telemetry.js contains a parallel dropper under an 'Analytics SDK' cover story using the same base64-chunk-decode + chmod 0o755 + cp.spawn('/bin/sh',...) pattern. The package advertises itself as a React form library but ships no form code; the fetched binary is unrelated to any documented purpose and delivers full-host code execution to any process that imports the module. ## Source: ghsa-malware (fc0f91cbc7f0e536c29d88d9d3de899ec807709956527adb6e7229664f2d1c5f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c) On require of the package, index.js loads _helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev), downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. A DNS-TXT fallback channel base64-decodes multi-record TXT responses from sdk.dl.wel1.ru into the payload bytes. lib/telemetry.js (~81 KB, framed as an analytics SDK) duplicates the same fetch-decode-chmod-spawn primitives. Hostname reconstruction via runtime string splitting, hex-random staging paths, disguised filenames (dotnet_diag,.cache_,.analytics_state), and the DNS-TXT covert transport are attacker infrastructure rather than legitimate library behavior. ## Source: ghsa-malware (6580ac910eec3a2cb20ce2e935a39da2549948bc1c702be53f911dfbac8d06ba) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b5813e9b97274c2eb3abd3459781550762baeea8c8fc0cec09603dac56a405d8) On require('devplatform-rest-client'), index.js loads _init.js which selects a platform-specific endpoint, downloads a binary from one of three Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback across four *.dl.wel1.ru subdomains, writes the payload to /tmp or %TEMP% under disguised names (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hosts and filenames are runtime-assembled from split string arrays; a cache-stamp file is named.analytics_state to mimic telemetry. A sibling module lib/telemetry.js (~81 KB, not referenced from index.js) contains a parallel dropper using indirect requires ('child_' + 'process'), base64 payload reassembly, chmod 0755, and detached /bin/sh spawn under a fabricated 'Analytics SDK' cover story. None of this behavior matches the package's advertised purpose as a REST client; index.js is trivial. ## Source: ghsa-malware (fbbcf53c505e7b9959afb047beac4365085ad239d61bae6098574e23f03a7771) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882) devplatform-select-fields@35.2.6 executes a binary dropper on any require() of the package. index.js loads _shim.js, which reconstructs C2 hostnames from split string fragments (Cloudflare Workers hosts of the form oob-worker.cf*-*.workers.dev, plus *.dl.wel1.ru), downloads a platform-specific payload over HTTPS, and falls back to a covert DNS TXT channel (reads a count from c.<domain> and reassembles a base64 payload from numbered TXT records). The payload is written to /var/tmp or %TEMP% under cover-story names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod 0755'd, and spawned detached via spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...). No hash or signature verification is performed. A setup() gate honors DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and writes an.analytics_state cool-down stamp (22583s) to suppress re-execution, framing the dropper as telemetry. Hostname string-splitting and the DNS-TXT reassembly path are anti-analysis measures. The package name resembles unrelated legitimate packages but the shipped code performs no advertised functionality. ## Source: ghsa-malware (65ad66039e3b7f7982e6539751ee90ae748d1de73569af1765aa15b4d1e0879a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26) index.js requires./_polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers subdomains (oob-worker.cf100-*.workers.dev / cf101/cf102/cf103 variants) with a DNS TXT chunked-base64 fallback via *.dl.wel1.ru. The payload is written under /var/tmp or %TEMP% with a cover-story name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0o755, and detach-spawned via /bin/sh -c "<file> &" or cmd.exe /c start /b. Destination hostnames and the child_process require are assembled by array-join string concatenation to evade static inspection. A second implementation of the same drop-and-exec chain (endpoint rotation, DNS TXT failover, chmod 0755, /bin/sh spawn) is present in lib/telemetry.js. There is no hash or signature verification, the hosts are anonymous mutable Cloudflare Workers unrelated to any declared publisher, and execution occurs automatically when the module is required. ## Source: ghsa-malware (36443e0787665837807370cbdc48a50575843492f93f4f657f3bb8b68bf54384) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cb9472f7623159163739228ed6ec07beb8599d3867f7c5215e4bf0e4bbde5a78) On require() of the package, index.js loads _vendor.js, which selects a platform-specific payload URL by joining string fragments to reconstruct Cloudflare Worker hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT chunked base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (e.g. 'dotnet_diag_*.exe', '.cache_*'), chmod 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() or spawn('cmd',...). Hostname fragments are array-joined at runtime and a helper suppresses console output, deliberately evading static inspection. The package name resembles a legitimate SPA plugin but the shipped _vendor.js is a dropper granting arbitrary remote code execution on any host that imports the module. ## Source: ghsa-malware (efc283f86f94400db2d3b8e9aea0b1c936d347f16a36df77dde30b00eb2c7980) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e) On require() of the package, index.js loads _runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscated Cloudflare Workers hosts (hostnames assembled at runtime via array-join, e.g. 'oob-worker.cf<NNN>-<hex>.workers.dev'), with a DNS TXT-record fallback channel under 'c.<domain>' / 'N.<domain>' that returns base64-encoded chunks decoded into the payload. The downloaded bytes are written to /tmp/.cache_<rand> (chmod 0755) on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, and spawned detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}).unref() or a cmd equivalent. Destinations are unrelated to the package's stated cobrowsing purpose, hostnames are obfuscated to defeat static analysis, and the payload is executed with no integrity check. ## Source: ghsa-malware (aa1e66a1340ad906053aaac4b55743c6d3e7efd724f6db8b8b81b7921962eb02) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (809274addc0525244480b108485ad3dbdba1a92b65025c1c48d549dd03c45f0b) On require of the package, index.js loads _bridge.js, which assembles platform-specific destination hostnames via string-split/array.join obfuscation and downloads an opaque binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked fallback channel (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<rnd>, dotnet_diag_<rnd>.exe), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(), with a marker file used to gate re-execution. A sibling module in lib/telemetry.js resolves child_process via 'child_' + 'process' string concatenation, corroborating deliberate static-analysis evasion. Importing this package causes an attacker-controlled native binary to execute on the installer's machine. ## Source: ghsa-malware (6eae746404d92a5c5a06e6a6c0f193dfe1cd697841d04c825513c6d711fad214) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8) index.js unconditionally requires./_loader on load. _loader.js reassembles Cloudflare workers.dev hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) from split-string arrays, with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (chunk-count from c.<domain>, base64 chunks from numbered subdomains). It fetches a platform-specific native binary, writes it to /var/tmp or %TEMP% under cover names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods 0755, and spawns it detached via /bin/sh -c '<file> &' or cmd /c start. A second module lib/telemetry.js (~81KB, disguised as an analytics SDK) duplicates the same fetch+chmod+spawn primitives using string-concatenated identifiers (require("child_"+"process"), fs["chmod"+"Sync"]) as a redundant stage. The i18next plugin name and analytics_state marker do not correspond to any translation functionality shipped in the tarball. ## Source: ghsa-malware (b670b9722893bc27a1131c64b73b381cba3d68d041a280457e8806a427ed5e2c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896) On require of the package's main entry, _support.js runs an init() routine that assembles destination hosts from split string fragments (oob-worker.cf100-416.workers.dev and siblings cf101/cf102/cf103, with a *.dl.wel1.ru DNS-TXT fallback), fetches an unsigned binary payload via https.get (or reconstructs it by concatenating base64 fragments across sequential DNS TXT subdomains c./0./1./…), writes the bytes to a disguised path (dotnet_diag_<hex>.exe under TEMP on Windows,.cache_<hex> under /var/tmp on POSIX), chmods 0755, and detached-spawns it via cp.spawn('/bin/sh', ['-c', path+' &'], {detached:true}) or cp.spawn('cmd.exe', ['/c','start','/b', path]). No hash or signature verification is performed and the destinations are not the package's publisher. Execution is gated to skip when DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are set or when npm_lifecycle_event === 'preuninstall', consistent with evasion of developer/CI/analyst environments. Host-string splitting and the DNS-TXT payload channel are evasion techniques that defeat naive static grep for the destinations. ## Source: ghsa-malware (7fe06d42c0c7ea9d4d5657015f0708a28ef85401c31872ac63709d61ed54f810) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (282ec333b26c6283eb35916acab1db10c1362d296d0694b1548882c6e48c06be) The package's main index.js unconditionally requires./_ext, which runs at load time and fetches a per-platform binary over HTTPS from string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev). If HTTPS fails, _ext.js falls back to a DNS TXT covert channel under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), querying c.<domain> for a chunk count then 0.<domain>, 1.<domain>,... and base64-decoding the concatenation into a binary. The fetched bytes are written to a randomly-named file in the temp directory (masquerading as.cache_<hex>, dotnet_diag_<hex>.exe, analytics_state), chmod'd 0755, and spawned detached via /bin/sh -c or cmd /c start /b. There is no version pinning, hash verification, or publisher-owned CDN, and the package's stated purpose (an SPA error-boundary component) has no legitimate reason to fetch and execute a native binary. Endpoint hostnames are assembled from split array literals at runtime to defeat static string scanning. Loading this package causes arbitrary attacker-controlled code to run on the installer's host. ## Source: ghsa-malware (52a6a2f9ca87decad3081725ea4293dce82d4c33a5afe1fdb9774776b95760be) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.