bcore-bravo-eslint-config @12.5.7

Summary

The package presents itself as an ESLint config / 'environment config reader' but on require() executes an import-time dropper. index.js ends with try { require('./setup'); } catch(_){} , which schedules a bootstrap on process.nextTick. setup.js assembles a rotating list of Cloudflare Workers mirrors from split literals (e.g. ["package-proxy.cf5oob","wor","ker.","wor","kers",".dev"] , and cf8/cf12/cf17/cf25 siblings), plus a *.dl.well1.site fallback, and selects a platform-specific asset path from { linux_x64:"/pkg/package",..., darwin_arm64:"/pkg/package-arm64", darwin:"/pkg/loader_mac", win32:"/pkg/package.exe" } . lib/telemetry.js fetches the response, base64-decodes it ( Buffer.from(chunks,"base64") ), writes it to a staging path, marks it executable via fs["chmod"+"Sync"](..., 0o755) , and executes it via require("child_"+"process") . Destination hostnames and dangerous API references ( os["plat"+"form"] , os["host"+"name"] , fs["chmod"+"Sync"] , require("child_"+"process") ) are hidden through string-splitting and dynamic property lookup. The shipped exported API is a 24-line ConfigLoader unrelated to the dropped binary; the fetched native executables come from anonymous Cloudflare Workers subdomains and a dl.well1.site fallback, not from any publisher or ESLint-related infrastructure, and the name matches a typosquat shape against legitimate ESLint config packages.

Source: amazon-inspector (fe55f411284226c68e60cbcae266a390a3ba0ef089a2a709363df3188130f605)