boxy-add-link @35.7.5

Summary

On require('boxy-add-link'), index.js loads _compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), retrieves an opaque binary over https.get, writes it to /tmp/.cache_<hex> on unix or %TEMP%\dotnet_diag_<hex>.exe on windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, the module reassembles a base64-encoded payload from sequential DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) and feeds the same write-chmod-spawn pipeline. Hostnames and API names (child_process, chmodSync) are constructed at runtime from split fragments to evade string scanning. A second, structurally identical dropper is staged in lib/telemetry.js but is not reachable from the main entry in this version.

Source: amazon-inspector (8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701)