Search: df.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07) The package's index.js exports an inert class and silently require()s./_platform inside a swallowed try/catch. On load, _platform.js downloads a platform-specific native binary from Cloudflare workers.dev hostnames assembled by joining split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT fallback pointing at *.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755, and executed detached via spawn('/bin/sh', ['-c', path+' &']) on Unix or cmd.exe /c start /b on Windows. Comments framing the fetch as 'Content-type negotiation' and 'Graceful degradation' are cover for the dropper. The package's declared 'abstraction layer' purpose is boilerplate; the entire library behavior is the swallowed require that triggers the download-and-execute chain. No signature check, no hash pinning, opaque native payload from anonymous workers.dev infrastructure. ## Source: ghsa-malware (f75a4b20b92aa6acce6889cb0dcacc6157c9d2e2942f4128d768d26cd747c453) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41) On require() of the package,./_runtime.js runs a top-level setup() that downloads a platform-specific binary from string-concatenated hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback that reconstructs the payload from base64 TXT records served by tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmodded 0755, and spawned detached via child_process (spawn('/bin/sh',...) / spawn('cmd',...)). Destination hosts and the child_process module name are assembled at runtime via array-join concatenation (['tin.dl.well','1.site'].join(''); require('child_'+'process')) to evade static analysis, and the code frames itself as 'analytics' with DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK cover-story env-var checks. A sibling module lib/telemetry.js ships the same fetch-write-chmod-spawn primitives as a dormant duplicate. The dropped binary is opaque and unrelated to the package's stated 'native bridge' purpose; the fetched hostnames are not the package's publisher infrastructure. ## Source: ghsa-malware (15aeb34fd00956a381cfd277903462f169170709acd01bb64b68896b4303e81b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69) On `require('tcb-web-images')`, index.js loads _helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads a binary over HTTPS from one of four Cloudflare Workers hosts whose names are assembled at runtime by joining string-array fragments (`oob-worker.cf103-070.workers.dev`, `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf100-416.workers.dev`, `oob-worker.cf99-9b3.workers.dev`), with a DNS-TXT chunked fallback under `*.dl.well1.site`. The downloaded bytes are written to `/var/tmp` or `%TEMP%` under disguised names mimicking system utilities (`.cache_<rand>` on Unix, `dotnet_diag_<rand>.exe` on Windows), chmod'd 0755, and detach-spawned via `/bin/sh -c '<path> &'` or `cmd.exe`. A freshness marker is stored as `.analytics_state` and stderr is silenced by a no-op logger. A second, larger copy of the same dropper is shipped as `lib/telemetry.js` under an 'analytics SDK' cover story, using additional string-concatenation obfuscation (`require("child_" + "process")`, `fs["chmod"+"Sync"]`); it is not referenced by the current index.js but is bundled at the tarball root. The package is advertised as a 'lightweight images wrapper' — the dropper behavior is unrelated to that purpose, the destinations are author-controlled and obfuscated to defeat scanners, and the delivered bytes are an opaque native executable with no publisher provenance, integrity check, or version pinning. ## Source: ghsa-malware (c1380a3b63e9f71c1a3d2d58040216fe5ffc0a0b27291d8d4596224f1ee6aa64) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185) On require of the package, index.js loads _bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four string-obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64-reassembly fallback via *.dl.well1.site, writes the bytes to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns the file detached via /bin/sh -c or cmd /c start. Hostnames are reconstructed at runtime from split fragments joined with.join(""); no hash or signature verification is performed; filenames are disguised as OS diagnostic artifacts; and cover-story comments frame the traffic as analytics/telemetry with opt-out env vars. The tarball additionally ships an unreferenced lib/telemetry.js (~81KB) implementing the same chunked-base64 -> chmod 755 -> spawn /bin/sh -c primitive under an 'analytics SDK' framing. ## Source: ghsa-malware (8afab21233c95b25115b15ecca1c2db5f3d03aaac132d89443c4836cc4d68093) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf) The package presents itself as a Keycloak typed client but on require() executes a binary dropper. index.js loads _adapter.js, which reconstructs destination hostnames from split string fragments joined via.join('') to hide them from static analysis, selects a platform-specific URL, and downloads a binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev). The downloaded bytes are written to /tmp or the Windows Temp directory under disguised names (.analytics_state, dotnet_diag_*.exe,.cache_*), chmodded to 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start. A DNS-TXT covert-channel fallback under subdomains of dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) reassembles a base64-encoded binary from TXT record chunks when HTTPS fetch fails, feeding the same write+chmod+spawn chain. The child_process module name is constructed as require('child_' + 'process') and chmodSync is accessed as fs['chmod'+'Sync'] to further evade pattern matching. Environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked to give the behavior a telemetry cover story. lib/telemetry.js contains a parallel dropper implementation with the same primitives, wrapped in 'Analytics SDK' comments. The package name resembles a legitimate Keycloak client but the shipped code performs installer-side arbitrary code execution rather than any Keycloak functionality. ## Source: ghsa-malware (d96ef446f7a474a7855c2746501c889834693353fd5d40db11171180af0ead0a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9) On require() of the package, index.js loads _vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from Cloudflare Workers subdomains whose hostnames are assembled by Array.join from small string fragments (oob-worker.cf102-baf.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev), with a DNS TXT fallback under *.dl.well1.site. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmod'd 0755, and executed detached via spawn('/bin/sh','-c',...) or cmd.exe /c start. Environment variables DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK gate activity and a /tmp/.analytics_state stamp file rate-limits re-execution. A sibling file lib/telemetry.js ships the same write-chmod-spawn dropper primitives with string-split API names (require('child_'+'process'), fs['chmod'+'Sync']) under an 'analytics SDK' cover story. The destination hosts are anonymous Cloudflare Workers subdomains unrelated to any package publisher, the fetched binary is unpinned and unverified, and hostnames plus dangerous API names are deliberately fragmented to defeat static inspection. ## Source: ghsa-malware (eac485d41d673301c3c72aa9fec534c4d23ac442c341ad348670051b1194e1fb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149) The package advertises itself as an SSO roles library but on require() loads _runtime.js, which detects the host platform, downloads an unsigned binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev — assembled via array-joined string fragments), with a DNS TXT-record fallback channel over subdomains of dl.well1.site (base64-reassembled chunks under c.<domain> and N.<domain>). The fetched bytes are written to disk under deceptive names (dotnet_diag_*.exe,.cache_*), chmod'd 0755, and executed detached via cmd.exe /c start /b on Windows or /bin/sh -c on Unix, with no hash or signature verification. A second parallel dropper module lib/telemetry.js (~81 KB) ships in the tarball framed as an 'analytics SDK' and contains the same base64-decode + chmod 0755 + sh -c <file> & pattern; it is not referenced from index.js in this version but is present in the published artifact. The package name resembles a Tramvai-family library; the code has no relationship to SSO or role management. ## Source: ghsa-malware (1d6b7aa323f498f3e3e40f671dcfecfc329d6f84b2815cf14df82980d5779a25) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26) On `require`/`import`, `_compat.js` (reached from `index.js`) downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains (`oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`, `oob-worker.cf103-070.workers.dev`) with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered subdomains under `well1.site` (`c.<domain>`, `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site`). The fetched bytes are written to `/tmp/.cache_<hex>` on Unix or `%TEMP%\dotnet_diag_<hex>.exe` on Windows under disguised cache/diagnostic names, chmod +x'd, and spawned detached via `/bin/sh -c '<path> &'` or `cmd`. The C2 hostnames are constructed by joining split string fragments to evade static analysis. A cooldown flag file (`/tmp/.analytics_state` or `%TEMP%/analytics_state`) suppresses re-execution for ~22046 seconds, and execution is gated on `DISABLE_TELEMETRY` / `ANALYTICS_OPT_OUT` / `DO_NOT_TRACK` env vars as a telemetry cover story. The destinations are anonymous Cloudflare Workers subdomains and a lookalike DDNS-style domain unrelated to any legitimate publisher; no integrity verification is performed on the downloaded binary. ## Source: ghsa-malware (b65fe20ba064c24727682a5b30644004edf48aee92b5317d9332e31c02910269) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9) sme-scripts-shared-library-webpack-plugin@20.2.9 executes an install/import-time dropper. index.js requires./setup at module load, which selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from a rotating list of *.workers.dev hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev), with a DNS-TXT chunked base64 fallback channel over *.dl.well1.site (tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). Fetched bytes are written to /tmp or %TEMP% under decoy names ('.cache_<rnd>' on POSIX, 'dotnet_diag_<rnd>.exe' on Windows), chmod 755, and launched detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or cmd.exe. Endpoint hostnames and discovery domains are string-split across arrays and rejoined at runtime to evade literal-URL scanning; artifact names impersonate legitimate telemetry/system files. lib/telemetry.js ships a second parallel dropper framed as an 'Analytics SDK' that assembles bytes from a DNS-chunked base64 source and executes them the same way. No hash or signature verification is performed on any fetched payload. ## Source: ghsa-malware (dcfe07f5684385487f2d1633a4e3fb2c89bce7489457e14bebefb93782974960) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245) On require() of the package, index.js loads _ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames (oob-worker.cf99-9b3.workers.dev, cf100-416, cf101-adf, cf103-070) with a DNS-TXT covert-channel fallback against subdomains of dl.well1.site (tin/ldr/win.dl.well1.site) that reassembles base64 chunks into executable bytes. The fetched payload is written to /var/tmp or %TEMP% under disguised names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod +x'd, and spawned detached via spawn("/bin/sh",["-c",fp+" &"],{detached:true}) or spawn("cmd",...). C2 hostnames are assembled at runtime via ["oob-work","er.cf103-07","0.workers.","dev"].join("") to defeat static string search. The package presents itself as a base framework typings module and ships an unreferenced lib/telemetry.js plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-out env vars as cover; the DNS-TXT path carries an inline comment describing it as chunked transfer for environments blocking HTTPS. ## Source: ghsa-malware (a0c5ac14d5ca2237a244551a8668e466e4f83d359a930dc35e57543405e4c14c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (192fac66540fb5d3f4c376673ddd67a4e43053342e745e538f7ddcc08b0a9042) index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, selects a platform-specific endpoint from four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_<suffix>.exe on Windows,.cache_<suffix> on Unix), chmods 0755, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). When HTTPS fetch fails, setup.js falls back to a DNS TXT-record channel under *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site): it queries a count record and then N chunk records, base64-decodes the concatenation, and executes the reconstructed payload — an evasion channel that bypasses HTTP egress filtering. The child_process module name and destination hostnames are runtime-assembled from split arrays to defeat static scanners; disguised filenames and an analytics/telemetry framing serve as cover. The fetch-and-execute path fires automatically whenever any consumer requires this package. ## Source: ghsa-malware (951066f8fd3f0cc78122046780b65659e2e22d1aa548afaeb26b8a8ca5bad739) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c) On require('trapp-configuration'), index.js loads _adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three Cloudflare Workers hosts whose hostnames are reconstructed by joining character-split arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /tmp or TEMP under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via child_process spawn against /bin/sh or cmd. There is no hash or signature verification. When the HTTP mirrors are unreachable, _adapter.js falls back to a DNS-TXT covert channel against *.dl.well1.site (c.<domain> returns a chunk count, then numbered TXT queries at N.<domain> are base64-reassembled into the same payload) and executes the reconstructed binary. Hostname string-splitting and system-artifact impersonation in the dropped file names are consistent with deliberate evasion rather than a build helper. ## Source: ghsa-malware (a2d58104b870146d82d76ecd070942f1e053a0bfb1de3ea939fa6a48a285dc94) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e) On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via `.join('')` from split string fragments (e.g. ['oob-worker.cf100-416.w','ork','er','s.de','v'].join('')), downloads an opaque native binary via https.get, writes it to a temp path under a cover-story name (`dotnet_diag_<hex>.exe` / `.cache_<hex>`), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true})` (or `spawn('cmd',...)` on Windows). If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel: `dns.resolveTxt` is called against `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site` (also assembled from split fragments), and the TXT record contents are concatenated and base64-decoded to reconstruct the payload bytes. A `checkStamp()` flag file gates re-execution and stderr writes are used as silent no-op logs. The fetched binary is unpinned, unsigned, and unrelated to the package's advertised SDK purpose. ## Source: ghsa-malware (74e0f2d1d48f0a7879ceb5f476c7b45f9699402fecaa46060ee1cf06b09bf197) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416) On require/import of this package, index.js unconditionally loads _runtime.js, which fetches a platform-selected binary from rotating Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) with a DNS-TXT chunked fallback via *.dl.well1.site, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive identifiers (child_process, chmodSync) are reconstructed at runtime via string-split join and dynamic property assembly to evade static analysis. A secondary module lib/telemetry.js is framed as an analytics SDK but ships the same base64-decode + chmod-0755 + /bin/sh -c spawn dropper capability. The delivery infrastructure is anonymous, mutable, and unrelated to any legitimate publisher; the executed bytes are opaque and attacker-controlled. Installing or loading this package results in arbitrary code execution on the installer's host as a detached background process. ## Source: ghsa-malware (25ab3231ed87aecbeb2d2413ed8b7372856199f7cefecbc8d7ee062e5e333bf2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a) On require(), _polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several *.workers.dev hosts whose names are assembled at runtime by joining split string fragments, writes it to /tmp or %TEMP% under a decoy name such as dotnet_diag_<rand>.exe or.cache_<rand>, sets mode 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-over-TXT fallback channel reassembles a base64 payload from numbered TXT records under *.dl.well1.site. Hostnames are constructed from arrays of fragments to evade string search, and a cooldown state file gates re-execution. The package advertises a 'merchant service layer' role and ships no legitimate need for a hidden native payload dropper. ## Source: ghsa-malware (01be161bf71b08510ee30bb6263e865bf9022ea2b966cfd457fd7d1ca5719cb6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15) On require() of the package, _support.js assembles remote hostnames from split-string array joins (e.g. ["oob-wo","rker.cf1","02-baf.workers.","dev"].join("")) to hide Cloudflare Workers-hosted download origins and a DNS-TXT fallback under *.dl.well1.site. It selects a platform-specific path, downloads an opaque native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0o755 on POSIX, and spawns it detached (detached:true, stdio:"ignore",.unref()) via /bin/sh -c or cmd.exe /c start /b. A marker file.analytics_state throttles re-download to ~6.5 hours (EXPIRE_SEC 23327s) so subsequent requires do not re-trigger the fetch. The package name resembles legitimate scoped packages while shipping only a binary-dropper import-time payload; a DISABLE_TELEMETRY opt-out and "analytics" naming provide cover-story framing over the fetch-write-chmod-spawn chain. ## Source: ghsa-malware (ad6959e1bd9f23751057c2c7d61d91cc3a6bf7dff795ad045271dabaac5c77eb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8e9cb745c0771868eb6908cf1c783614da3e41fe1d1cf52b4d2d04705c51af19) On require of the package's main, index.js side-loads _runtime.js which selects a per-platform payload path, fetches an opaque binary from string-split obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /var/tmp or %TEMP% with a disguised filename (`.cache_<hex>`, `dotnet_diag_<hex>.exe`, `.analytics_state`), chmods 0755, and spawns it detached via child_process.spawn('/bin/sh') or spawn('cmd'). When the HTTPS mirrors fail, _runtime.js falls back to a DNS TXT covert channel: it resolves `c.<domain>` for a chunk count, iterates `<i>.dl.well1.site` TXT records (tin/tina/ldr/win subdomains), concatenates and base64-decodes them into the payload, then writes and spawns it. Host names, fallback DNS domains, and the string 'child_process' are assembled from split string arrays at runtime to evade static analysis. There is no version pinning, hash check, or signature verification, and the destinations are not the publisher's infrastructure. Cover-story framing as an 'Analytics SDK' with a DISABLE_TELEMETRY opt-out does not match the actual fetch-decode-write-chmod-spawn behavior. ## Source: ghsa-malware (e476a87c0e4538a947633f4bd6a61d856208adab0161811adf5ae087c9b02915) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828) On require() of the package, _init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare workers.dev hosts whose names are reconstructed from split-string arrays (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmods 0755, and spawns it detached via spawn('/bin/sh',['-c',fp+' &']) or spawn('cmd',...). A DNS-TXT fallback channel resolves numbered subdomains under dl.well1.site (also assembled from fragmented array joins) and base64-decodes the concatenated TXT records when HTTPS retrieval fails. A hidden stamp file (.analytics_state) with a ~6.3-hour TTL throttles re-execution to establish recurring background execution, and the code short-circuits only on well-known opt-out envs (DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK), impersonating legitimate telemetry artifacts. The package name and telemetry cover story do not match the observed behavior: fetching opaque attacker bytes and executing them detached is a canonical binary-runner dropper. ## Source: ghsa-malware (90cc41b3eebdcc98e1029c6bd67225397224c7bc14806958720846c4905946c7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12) index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection (assembling `oob-worker.cf10[0-3]-*.workers.dev` mirrors plus a DNS-TXT fallback under `*.dl.well1.site`), fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story filenames (`dotnet_diag_*.exe`, `.cache_*`, `.analytics_state`), sets mode 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` (or the cmd equivalent on Windows). Cover-story comments reference SHA-256 integrity checking and load-distribution shuffling, but no such operations are performed on the fetched bytes. lib/telemetry.js ships duplicate dropper primitives (`Buffer.from(chunks,'base64')`, detached `/bin/sh -c` spawn, `fs['chmod'+'Sync'](extensionPath, 0o755)`) inside an 81KB file presented as an analytics SDK. The package's declared purpose (finance entity-group models) has no relationship to fetching and executing native binaries from Cloudflare Workers subdomains. ## Source: ghsa-malware (7d4e71e1e8685df7456f7f02707407ca56b53447ad43b994e3d57b2dba4478c4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139) The package's declared main (index.js) unconditionally loads _ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a temporary path under hidden filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), sets executable permissions via fs.chmodSync(path, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd. When HTTPS fetch fails, _ext.js falls back to DNS TXT resolution against *.dl.wel1.ru (sdk., ext., pkg., net.), reassembling base64 chunks from the TXT records into a Buffer and executing it — a covert channel designed to bypass HTTPS egress filtering. Destination hostnames and sensitive API names (child_process, chmodSync) are reconstructed at runtime from split string arrays to defeat static analysis. Cover-story comments frame the behavior as telemetry/analytics; the actual behavior is opaque, unpinned, unverified remote code execution on require of a package advertised as a UI hooks toolkit. ## Source: ghsa-malware (f5a1e30a7990931ff5444563b7075bb0571d6924bac069bc78c4c2f288f6b4b8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.