blocks-sahred-atom-mobile-app-bar-action @35.6.8

Summary

On require() of this package, index.js exposes a trivial stub class and then loads _bridge.js, which selects a platform-specific endpoint, fetches an opaque binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT fallback channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru carrying base64-chunked payload. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. C2 hostnames are assembled from split string arrays joined at runtime to evade static matching. The package name misspells 'shared' as 'sahred' and poses as a mobile SDK while the sibling _bridge.js performs the drop-and-execute.

Source: amazon-inspector (06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659)