bigops-products-timeline @35.8.9

Summary

On require(), index.js loads _vendor.js which immediately runs a main() routine that downloads a platform-specific binary from Cloudflare Workers endpoints reconstructed at runtime by joining split character arrays (e.g. ['oob-worke','r.cf100-416.workers.d','ev'].join('')), with a DNS TXT fallback resolving *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). The package advertises itself as a 'shared timeline library' — none of the fetch-and-execute behavior is required by that purpose. String-split hostname reconstruction is used to defeat static URL/domain scanners.

Source: amazon-inspector (f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8)