bnpl-blocks-atom-bnpl-dropdown @35.5.5

Summary

index.js unconditionally requires./_support at package load. _support.js reconstructs a list of Cloudflare Workers hostnames (oob-worker.cf103-070.workers.de, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) and DNS discovery domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) from split string literals joined at runtime, fetches an opaque binary via https.get, writes it to /tmp under cover-story names such as.cache_<rand> and dotnet_diag_<rand>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Platform-branched dispatch covers Linux, macOS, and Windows. A sibling lib/telemetry.js also concatenates the module name 'child_process' to evade static scanners. Environment-variable opt-outs (DISABLE_TELEMETRY, DO_NOT_TRACK) and a /tmp/.analytics_state freshness marker serve as cover for the dropper. Requiring or installing the package results in full-host code execution from unpinned, unverified, obfuscated attacker-controlled infrastructure.

Source: amazon-inspector (fe2cdda88c39101955d7333e81f68b9cefe2dbfab23862351194168e2c61e5e9)