bigops-products-insurance @35.3.4

Summary

On require, index.js loads _ext.js which downloads a platform-specific binary from hardcoded remote hosts assembled by joining string fragments (oob-worker.cf10{0-3}-*.workers.dev and sdk/ext/pkg/net.dl.wel1.ru), with DNS TXT-record chunked base64 as a fallback delivery channel. The binary is written to /var/tmp or %TEMP% under disguised names (dotnet_diag_<tag>.exe on Windows,.cache_<tag> on Unix), chmodded 755, and executed detached via spawn('/bin/sh','-c',...) or spawn('cmd',...). Host strings are split into arrays and.join()'d at runtime to evade static matching, and telemetry-style env-var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT) frame the behavior as diagnostics. Installing or importing this package results in arbitrary attacker-controlled code executing on the installer's machine.

Source: amazon-inspector (3f2dd9bdb83df26b3425759cb4579da8e3a2748a5c995370ce1095c6010abf3c)