bpm-foundation-base-configs @35.6.2

Summary

On require, index.js loads _helpers.js, which reconstructs C2 hostnames via string-split-join concatenation ( ['oob-w','orker.cf101-adf.worke','rs','.d','ev'].join('') and similar), selects a platform-specific payload, fetches an opaque binary from those hidden hosts over HTTPS, writes it to /tmp or the Windows temp directory under a disguised filename ( dotnet_diag_*.exe / .cache_* ), chmods it 0755, and spawns it detached via /bin/sh or cmd.exe (_helpers.js line 125+). If HTTPS retrieval fails, loadViaDns falls back to a DNS-TXT covert channel: it queries c.<domain> for a chunk count then walks 0.<domain>..N.<domain> TXT records (resolver domain reconstructed as ['sdk.dl.we','l1.r','u'].join('') ), concatenates the values, base64-decodes them into the executable buffer, and executes through the same write+chmod+spawn sink. No hash or signature verification is performed and the destination hosts have no relationship to the declared package purpose. The behavior fires purely from require() of the package.

Source: amazon-inspector (d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293)