boxy-fixture-allure @20.8.1

Summary

boxy-fixture-allure ships an index.js that unconditionally requires./_shim on load. _shim.js reconstructs C2 hostnames via runtime string-splitting/.join() over fragments (assembling *.workers.dev CDN endpoints and a DNS TXT-record fallback under *.well1.site), fetches a platform-specific native binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0o755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Payload naming (dotnet_diag,.cache_, analytics_state) and the presence of opt-out environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) serve as cover for the drop-and-execute behavior. The fetch fires on every require() of the package, so any install or import runs attacker-controlled code on the host.

Source: amazon-inspector (ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc)