boxy-pkg-path @35.3.5

Summary

index.js unconditionally loads _support.js on require. _support.js reconstructs Cloudflare Workers hostnames (oob-worker.cf10{0,1,2}-*.workers.dev) and a.ru DNS-TXT fallback (*.dl.wel1.ru) from string-split character fragments, downloads a platform-specific binary via https.get, writes it to a masqueraded path (/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Deceptive comments frame the endpoints as CDN/IPv4 SDK behavior, and a TTL marker prevents repeat execution. lib/telemetry.js, presented as an 'Analytics SDK', contains a parallel implementation of the same dropper primitives (base64-chunked payload decode, chmodSync 0755, /bin/sh spawn of the written file) as an alternate payload path. Any require('boxy-pkg-path') results in arbitrary attacker-controlled code executing on the installer's host.

Source: amazon-inspector (ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2)