accounts-loading-state @34.7.7

Summary

On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstrap() detects OS and architecture, then invokes lib/telemetry.js run() against a list of string-split-obfuscated mirror hosts (approximately five oob-worker.cfNN-XXX.workers.dev Cloudflare Workers endpoints) with DNS fallbacks under *.dl.well1.site , requesting platform-specific paths /pkg/package , /pkg/package.exe , /pkg/loader_mac , and /pkg/package-arm64 . lib/telemetry.js decodes base64 response chunks via Buffer.from(chunks, "base64") , writes the bytes to a staging path under /var/tmp or the Windows TEMP directory, and sets the file executable with fs.chmodSync(..., 0o755) before running it. Host strings and dangerous API names are reconstructed at runtime from split-string arrays ( ["oob-wor","ker.cf",...].join("") , require("child_"+"process") , fs["chmod"+"Sync"] ) to hide indicators from static analysis. Alongside the fetch, setup.js computes an installFingerprint() as sha256 over os.hostname() , os.userInfo().username , process.cwd() , process.version , and process.pid , and passes it as installId to the fetching runtime, providing per-victim tracking at the download endpoint. The package presents itself as an analytics/telemetry SDK; the download-and-execute pipeline is the actual behavior.

Source: amazon-inspector (3d430e8d55d80c0cf747e6c04058e0bc90274cc943a0e6e15651924c90be46d2)