Search: at.exe

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766) Package advertised as an icon loader but on require() the bundled _vendor.js downloads a platform-specific executable from obfuscated Cloudflare workers.dev subdomains and *.dl.wel1.ru hosts (oob-worker.cf102-baf.workers.dev, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp or %TEMP% under disguising names (dotnet_diag_*.exe,.cache_*), chmods it 0o755, and spawns it detached via /bin/sh or cmd. Destination hostnames and the child_process require target are reconstructed at runtime via array.join("") splits to evade static scanners. If HTTPS mirrors fail, _vendor.js falls back to a DNS-TXT covert channel that queries c.<domain> for chunk count then N.<domain> for base64-encoded chunks, reassembles the executable, and feeds it to the same write/chmod/exec sink. Behavior does not match the package's declared purpose. ## Source: ghsa-malware (03baa2c099e2df5b44af4bdd58c79ed8cb97069284035967f7de9efaf1e30df1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11) Requiring the package loads _vendor.js, which reconstructs remote hosts from array-join fragments (resolving to Cloudflare Workers hosts such as oob-worker.cf*.workers.dev and a *.dl.wel1.ru fallback discovered via DNS-TXT), downloads a platform-specific binary over HTTPS with no hash or signature verification, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. A TTL stamp is used to avoid re-fetching on subsequent loads. The advertised purpose (a BNPL button UI set) has no legitimate need for downloading and executing an external binary, and the destination hosts are obfuscated to defeat static string scanning. ## Source: ghsa-malware (96364d87dda8ba23b8c1880ed8f6ea480ed5841987390a2bbb12daf8f341a0d1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc) On require of this package, index.js loads _bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembled Cloudflare Workers hosts (assembled from split fragments joined with.join('') to hide the destination, resolving to oob-worker.cf10x-*.workers.dev). The binary is written under /var/tmp or %TEMP% with disguised names such as dotnet_diag_<rand>.exe or.cache_<rand>, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A DNS-TXT fallback channel under *.dl.wel1.ru (resolver domains also assembled from split fragments) reads a count from c.<domain> TXT and iterates <n>.<domain> TXT records, base64-decoding the concatenation into an alternate payload delivery resilient to HTTP egress filtering. Destination hosts and resolver domains are obfuscated via string-split concatenation. ## Source: ghsa-malware (c59af5d56a9c3d1af7e4f4f942e01a23a353c1dd843393c7f3dd481cfe78aab0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241) On require(), index.js loads./_platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers subdomains (oob-worker.cf*-*.workers.dev), fetches an opaque platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c '<path> &' on Unix or cmd.exe /c start /b on Windows. A DNS TXT-record fallback (c.<domain> gives chunk count, N.<domain> gives base64 chunks reassembled from hosts like sdk.dl.wel1.ru) provides a covert retrieval channel when HTTPS is blocked. No hash or signature verification is performed; destination hosts are not associated with the package's publisher; hostnames are assembled at runtime specifically to defeat static analysis. Merely importing the package causes a remote binary to be executed on the installer's host. ## Source: ghsa-malware (f33ce5c5b7fe94e058599e2978bb7bb71d68d00d06b3a6e9ab32d431c186d266) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42) On require of the package, index.js unconditionally loads _bootstrap.js, which downloads a platform-specific binary from hostnames assembled via split-string concatenation (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with fallbacks to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru and a DNS TXT-record base64-chunk retrieval channel. The downloaded binary is written to /tmp or %TEMP% under a decoy hidden filename (.cache_<uid>, dotnet_diag_<uid>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and API names are runtime-assembled ("child_"+"process", "chmod"+"Sync") to defeat static scanners. A second, larger implementation of the same drop-and-exec pattern is shipped as lib/telemetry.js under an 'analytics SDK' cover story. ## Source: ghsa-malware (00ac66bbc4c02b2579e227b39cd22b64e933989d8526b03c561886cd85d67abc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6) On require() of the package's main entry, _runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback resolving hosts under dl.wel1.ru (sdk./ext./pkg./net.), writes it to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c... & or cmd /c start. Hostnames are assembled at runtime from split-string arrays and child_process is loaded via a runtime require() inside _activate(), consistent with static-scanner evasion. Filenames masquerade as dotnet_diag /.cache and a TTL marker (analytics_state) rate-limits re-execution. Installing or requiring this package yields full-host code execution on the installer under attacker-controlled bytes. ## Source: ghsa-malware (20ea76efd9c7012010991937c1135b107f66754480f47907e869438deeee3bed) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656) On require() of this package, index.js loads _compat.js which selects platform-specific endpoints assembled from split string arrays (e.g. oob-worker.cf10-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) and downloads an opaque binary via https.get. If HTTP fetch fails, a fallback path reassembles a base64 payload from numbered DNS TXT records under *.dl.wel1.ru — a covert channel designed to bypass HTTP egress controls. The fetched bytes are written to /var/tmp or %TEMP% under a disguised name (.cache_XXXX on POSIX, dotnet_diag_XXXX.exe on Windows), chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe. A second module lib/telemetry.js (81KB) bundled in the tarball mirrors the same fetch/chmod/spawn chain using string-concatenation obfuscation of 'child_' + 'process' and 'chmod' + 'Sync', framed as an Analytics SDK; it is not reached from index.js in this version but is a one-line change from activation. The package name presents as a Dolyame BNPL desktop UI component, unrelated to the observed dropper behavior. No hash verification, no publisher pinning, and hostname obfuscation together characterize this as a lure package delivering attacker-controlled code to the installer's host at require() time. ## Source: ghsa-malware (9f0aa16f494a5d70cf4769b18a5b7e086890f408ab68a92432c2923ff1bcce88) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945) On require of the package, _runtime.js selects an OS/arch-specific payload (linux_x64, linux_arm64, darwin, win32), downloads a binary from string-split-obfuscated *.workers.dev mirrors (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT-record fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that base64-decodes assembled chunks, writes the bytes to /tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe /c start. Host strings are assembled via array.join() to evade static analysis, and cover-story naming ('.analytics_state', 'dotnet_diag_', 'telemetry' comments) is layered over the dropper. The declared purpose of the package (a BNPL payment popup) does not require importing or executing a fetched native binary. ## Source: ghsa-malware (cf143f6664d3a792cef531065788e7a5792d2f9e0c63a80ad0c97b6804ffba40) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (95d52abe2ced4314ede2df4d3475d73fb87f52298434cdbf6469bf057613346f) index.js unconditionally requires./_init at module load time. _init.js selects a platform-specific path, fetches an opaque native binary over HTTPS from a rotating set of Cloudflare Workers subdomains whose hostnames are assembled at runtime via array.join("") to evade plain-text scanning (e.g. oob-worker.cf99-9b3.workers.dev, cf101-adf/cf103-070/cf100-416.workers.dev), writes it to /tmp or %TEMP% under a disguised name, chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A fallback covert channel queries TXT records at c.<domain> and N.<domain> under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenates the chunks and base64-decodes them into the same executable payload. Requiring or installing the package results in execution of attacker-controlled native code on the installer host. ## Source: ghsa-malware (14cb62d811a687032f1374c803415b84f5bba3715c074381da656dda3e4ce1b0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54) Requiring dolyame-boxy-desktop-bnpl-footer causes _platform.js to execute at load time: it reconstructs destination hostnames from split string arrays (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows (masquerading as a.NET diagnostic file), chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. If HTTPS delivery fails, dnsChunked() falls back to a DNS-TXT covert channel under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru), resolving c.<domain> for a chunk count and reassembling base64 TXT records into the executable. Destinations and dangerous APIs are obfuscated via Array.join('') and dynamic property lookups (require('child_'+'process'), fs['chmod'+'Sync']). A second copy of the same dropper is bundled in lib/telemetry.js behind an 'Analytics SDK' cover story. No hash or signature verification is performed on the fetched binary. ## Source: ghsa-malware (ed53f94a9d9ca52e9bddfc8c9890a6a6e474f6eae42ec55c4557ba1876ea4aa5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee) The package `main` (`index.js`) requires `./_init` on load. `_init.js` assembles hostnames via string-split `.join('')` obfuscation to produce a rotating list of Cloudflare Workers endpoints (`oob-worker.cf103-070.workers.dev`, `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf100-416.workers.dev`, `oob-worker.cf101-adf.workers.dev`) plus a DNS-TXT covert-channel fallback via `*.dl.wel1.ru` (`sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, `net.dl.wel1.ru`). It downloads a platform-specific binary, writes it to `/var/tmp` or `%TEMP%` under disguised names (`dotnet_diag_<rand>.exe`, `.cache_<rand>`), sets mode 0755 on POSIX, and spawns it detached via `/bin/sh -c... &` or `cmd /c start /b`. Environment flags such as `DISABLE_TELEMETRY`, `ANALYTICS_OPT_OUT`, and `DO_NOT_TRACK` act as kill switches. A second dropper is bundled in `lib/telemetry.js` (81 KB), which reconstructs a payload from base64-encoded DNS TXT chunks and executes it using the same detached-shell pattern, hidden behind `require('child_'+'process')`, `fs['chmod'+'Sync']`, and an `analytics-sdk` cover story. The package's advertised purpose has no relationship to any such native runtime. ## Source: ghsa-malware (2c6b20a72d52db6e703edf3d70652989c61e881ea98641fcdbfd73847d7452a5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3) On require() of dolyame-boxy-fonts, index.js unconditionally loads./_loader.js, which reconstructs C2 hostnames from split-string arrays (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and a DNS-TXT fallback channel under *.dl.wel1.ru (chunk-count via c.<domain>, base64 chunks via N.<domain> retrieved through dns.resolveTxt). _loader.js downloads a platform-specific binary, writes it to /tmp or %TEMP% under a hidden/decoy name (.cache_<rand> or dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. The fetched bytes are opaque, unpinned, and not hash-verified, and the destination hosts are anonymous Cloudflare Workers subdomains assembled at runtime to defeat static grep. A sibling module lib/telemetry.js ships in the tarball with the same dropper primitives (require('child_' + 'process') string-split, fs['chmod' + 'Sync'], cp.spawn('/bin/sh', ['-c', filePath + ' &'])), providing an alternate execution path. Installing or requiring this package causes attacker-controlled code to execute on the installer's machine. ## Source: ghsa-malware (8fc78c53700a2acd4b24e0604a5f8b99e8e425b04b17a32aae2ed79ae8422be9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2) On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT covert-channel fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The payload is written to /tmp or %TEMP% under a disguised name (dotnet_diag_<uid>.exe on Windows,.cache_<uid> on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification, hostnames are assembled from array fragments joined at runtime, and the download destinations are unrelated to the package's stated BNPL-cards purpose. A lockfile named.analytics_state and opt-out env vars named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are used as a telemetry cover story. ## Source: ghsa-malware (52dea7d898c8f1e0fa0c6af08e0ada75adc49dfbfc69a89ba5068f4bd9a7b5af) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a) index.js require()s _platform.js on load, which reconstructs hostnames from split string arrays (oob-worker.cf10*-*.workers.dev and sdk.dl.wel1.ru) to hide destinations from static inspection, then HTTPS-fetches an opaque binary payload from those hosts with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a randomized hidden filename (.cache_<rand> / dotnet_diag_<rand>.exe), chmod 0755, then spawned detached via /bin/sh -c or cmd.exe (_platform.js line 119-125). No hash or signature verification is performed, and the fetched payload is unrelated to the package's advertised BNPL container purpose. A.analytics_state marker file and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-out flags provide cover-story framing over the loader. The dropper fires at module require time. ## Source: ghsa-malware (ae1645a20f33890b6484de65fd02e51744251f379954bf7a61caa228be7fcc44) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a) On require(), _bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-transfer fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. Host names and resolver domains are assembled from split string fragments (e.g. ['oob-worker.cf100-416.worke','rs.dev'].join('')) to defeat static analysis. A flag file named /tmp/.analytics_state is used as a run stamp, but the package ships no analytics functionality — the name is cover. Execution is guarded only by opt-out env vars, so a default install-and-require chain runs the attacker-controlled binary with the invoking user's privileges. ## Source: ghsa-malware (124a13dcdb80c3bd90e3029669fb50c0ee496ede277e0a8ac1be8f8efe1a3f7e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b31579fb9a360c4781524c5edd9d0e7b84440e7ccd073e09d54afc10678764cf) On require() of this package, index.js loads _compat.js which unconditionally downloads an OS-specific binary from Cloudflare Workers hosts assembled at runtime via string-array join (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev), with a DNS-TXT chunked fallback served under *.dl.wel1.ru (sdk.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under cover-story filenames (analytics_state, dotnet_diag_*.exe,.cache_*), chmod 0755 on POSIX, then spawned detached and unref'd via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification, no relationship to any legitimate publisher, and the hostnames and the child_process require are obfuscated via array.join to defeat static analysis. Package name impersonates a Dolyame BNPL integration but ships no such functionality. ## Source: ghsa-malware (abfed9e023b5c6d17fc35410b41929bf6d447e802a33a2bcb83cb7fd483d8626) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9) On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g. "oob-worker.cf99-9b3.worker" + "s.dev"), downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev) with a DNS-TXT covert-channel fallback (base64 chunks reassembled from resolveTxt of numeric subdomains under dl.wel1.ru), writes the payload to a disguised path under /tmp or %TEMP% (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755 on Unix, and spawns it detached via /bin/sh or cmd.exe. A state file throttles re-runs. Package name resembles a legitimate BNPL/payment integration but the shipped code implements a remote-payload dropper with no relation to that stated purpose. ## Source: ghsa-malware (5d31c7a4f92cc32521ef343a86ff4d50644dd80a95c698b2b370a68e4e767219) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae) On require() of the package, index.js loads _ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (c.<domain> for chunk count, i.<domain> for base64-reassembled payload chunks across sdk/ext/pkg/net subdomains). The fetched bytes are written to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe /.cache_<hex>), chmod 755'd, and spawned detached via /bin/sh -c or cmd /c start. Destination hostnames are reconstructed via array-join to evade static string scanning. The behavior is framed as opt-out telemetry (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks,.analytics_state file), and lib/telemetry.js contains a parallel Buffer.from(chunks,'base64') + fs.chmodSync + cp.spawn('/bin/sh',['-c', filePath+' &']) code path that corroborates the write-chmod-exec pattern. ## Source: ghsa-malware (f19d34835a9a9239da98c35195bbeefb0f0b5f67e698897c2730cdf4b8262b90) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681) On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked base64 fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under deceptive names such as dotnet_diag_*.exe and.cache_*, chmod 0755 on POSIX, then spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A second ~81 KB module at lib/telemetry.js, framed as an 'Analytics SDK', reimplements the same fetch/write/chmod/spawn chain and DNS-TXT reassembly as a redundant dropper. Hostnames and sensitive API identifiers ('child_process', 'chmodSync', 'workers.dev', 'dl.wel1.ru') are reconstructed at runtime via Array.join and bracket-property concatenation to evade static analysis. Opt-out environment variables and a TTL lock file are present as cover-story hygiene but do not constitute consent. ## Source: ghsa-malware (36e37533131ea5ce9d4a73dfa8680516c916abc9b3eb719a4678fdb8cd8f1f31) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310) On require of the package, index.js unconditionally loads _bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked fallback that reassembles base64 content across numbered subdomains of sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmod 0755 on POSIX, and executed detached via spawn("/bin/sh",...) or spawn("cmd",...). Destination hostnames are assembled from fragmented arrays joined at runtime to evade static analysis; the file is staged under masquerading names (dotnet_diag_,.cache_) and gated behind DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK cover-story environment variables. The package's advertised purpose (a picture-gallery / BNPL support module) has no legitimate need to download and execute a native binary from anonymous edge-worker hosts with no version pinning, no publisher-controlled origin, and no hash or signature verification. ## Source: ghsa-malware (93b7d20b5c9d5f24d8d4b343681dbe0e37ec95816667d008a60fe956e8714e66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.