boxy-use-calls @35.1.8

Summary

index.js unconditionally requires _bridge.js, whose top-level main() runs on import. _bridge.js selects a platform-specific payload path, downloads an opaque binary via https.get from one of several string-split Cloudflare-Workers hosts assembled by.join('') (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), writes it to a disguised filename under /tmp or %TEMP% (e.g..cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and detached-spawns it via /bin/sh -c or cmd /c start with.unref(). A fallback channel queries DNS TXT records under c.<domain> and sequentially-numbered subdomains of *.dl.wel1.ru to reassemble a base64-chunked payload when HTTPS is blocked. A 21376-second replay-suppression stamp is written under an 'analytics_state' key. No pinning, no signature check, no publisher-matching source. A separate lib/telemetry.js file presents an 81 KB 'analytics SDK' that is never referenced by index.js or _bridge.js and shares DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env-var names with _bridge.js, serving as cover-story camouflage for the dropper.

Source: amazon-inspector (41e7b8d0b1d87131f56439454c512c68c367ed421c04c7a4bc165c7aeb6acdd6)