boxy-fixture-pfa @35.3.4

Summary

On require() of the package, _polyfill.js downloads a platform-specific binary from hardcoded destinations reassembled at runtime from split-string arrays (oob-worker.cf1006.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp under a hidden name (.cache_<hex>) or to %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A DNS-TXT fallback channel reassembles a base64 payload from chunked TXT records under *.dl.wel1.ru when HTTPS is blocked. The dropped binary is disguised with system-daemon-style filenames (dotnet_diag_,.cache_,.analytics_state) and the code carries opt-out checks on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK as cover framing. A second dropper module lib/telemetry.js (81 KB, labeled 'Analytics SDK') ships the same base64-decode -> filesystem write -> chmod 0755 -> cp.spawn('/bin/sh', ['-c', filePath + ' &']) chain with split-property-name obfuscation (child_'+'process, chmod'+'Sync); it is not referenced from index.js in this version but is present in the tarball as an alternate loader. Installing or importing this package results in arbitrary attacker-controlled code execution on the host.

Source: amazon-inspector (0a15e41a397b63d04216419ddd8ec88f37cb68c5d35997ad840543e034f87d8f)