bpm-foundation-date-range @35.4.2

Summary

Requiring the package's main entry triggers _polyfill.js, which selects a platform-specific endpoint and downloads a native binary over HTTPS from hostnames assembled by Array.join from split string fragments (Cloudflare Workers mirrors such as oob-worker.cf*-*.workers.de). If HTTPS mirrors fail, a covert DNS-TXT retrieval channel keyed by platform (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) reconstructs the binary from base64-chunked TXT records. The downloaded bytes are written to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmodded 0755 on POSIX, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start. No hash or signature is verified, the payload host is not the package publisher, and the package's advertised purpose (a date-range utility) has no legitimate need to fetch or run a native binary.

Source: amazon-inspector (fac5d5e2ebbf743977ac3ac1149da83ee41c1b7b98b10e97619e83fd3a18550c)