beaver-ui-pagination @35.3.7

Summary

On require('beaver-ui-pagination'), index.js loads _init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback via *.dl.wel1.ru subdomains. The fetched binary is written to /var/tmp or %TEMP% under a disguised name (.cache_<rnd> on POSIX, dotnet_diag_<rnd>.exe on Windows), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled at runtime from array.join to evade static inspection, and env-var opt-outs (DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK) plus an 'analytics_state' marker file frame the behavior as telemetry despite the fetch-and-execute flow. A sibling lib/telemetry.js not currently reachable from index.js ships a second copy of the dropper primitives (dynamic require('child_'+'process'), base64-chunked buffer, chmodSync 0755, /bin/sh spawn of a filePath).

Source: amazon-inspector (2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb)