boxy-semver @35.3.5

Summary

index.js unconditionally requires./_init on load. _init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts assembled by split-string concatenation (oob-worker.cf99-9b3.workers.dev), with a DNS-TXT fallback resolver at sdk.dl.wel1.ru, writes the payload to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames, the require("child_process") call, and fs.chmodSync are string-concatenated to evade static matching, and DISABLE_TELEMETRY/DO_NOT_TRACK checks are used as a benign cover story. A second module lib/telemetry.js (~81KB, not reached from the current index.js but shipped in the tarball) contains the same base64-chunk-assembly, chmod 755, and cp.spawn('/bin/sh',['-c', filePath+' &']) dropper primitives. Executable filenames mimicking dotnet diagnostics and hidden.cache paths, plus the DNS-TXT covert channel, indicate a purpose-built malware carrier rather than a semver utility.

Source: amazon-inspector (dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83)