boxy-fixture-sb @35.9.6

Summary

On require() of boxy-fixture-sb, index.js loads _compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays (joined at runtime to form oob-worker.cf*.workers.dev), downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start. A DNS-TXT fallback channel reads base64 payload chunks from c.<domain>/<i>.<domain> under *.dl.wel1.ru. Cover-story identifiers (analytics_state, DISABLE_TELEMETRY) and hostname obfuscation confirm evasion intent. The package name suggests a test fixture but its only observed effect at import is fetching and executing an opaque remote payload on the installer's machine.

Source: amazon-inspector (569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07)