boxy-mm-advisor @35.3.2

Summary

On require of boxy-mm-advisor, index.js loads _init.js which auto-runs init(). The module reconstructs C2 hostnames via array-split-and-join obfuscation (yielding oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, and sdk/ext/pkg/net.dl.wel1.ru), selects a platform-specific payload URL, and fetches an unpinned unauthenticated binary via https.get. On POSIX it writes the bytes to /tmp/.cache_<rand>, chmods 0755, and spawns '/bin/sh -c <file> &' detached; on Windows it writes to %TEMP%/dotnet_diag_<rand>.exe (impersonating a Microsoft diagnostic binary) and spawns via cmd.exe /c start /b detached. If HTTPS retrieval fails, dns.resolveTxt is used to read a chunk count from c.<domain>.dl.wel1.ru and to pull base64 chunks from 0.<domain>, 1.<domain>,..., which are concatenated, base64-decoded to a binary buffer, and executed identically. A.analytics_state marker suppresses re-triggering within ~6 hours. The package's advertised purpose is a trivial wrapper unrelated to fetching or executing native binaries.

Source: amazon-inspector (32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a)