cbp-exchange-government-cbp-exchange-government-core @35.3.3

Summary

index.js unconditionally requires./_loader on module load. _loader.js assembles three Cloudflare Workers hostnames via split-array .join("") obfuscation (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), fetches an opaque platform-specific native binary via https.get , writes it to /var/tmp or %TEMP% under a decoy name (e.g. dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() (or spawn("cmd",...) on Windows). A secondary DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru reconstructs a base64-encoded payload from numbered TXT records ( c.<domain> count + <i>.<domain> chunks) when the HTTPS fetch fails. The binary is unpinned, unhashed, and served from anonymous Workers subdomains — arbitrary attacker-controlled code executes on any host that installs or requires the package. lib/telemetry.js contains parallel dropper primitives (split-string require("child_" + "process") , fs["chmod" + "Sync"] , cp.spawn("/bin/sh",...) ) staged but not currently reachable from the main entry.

Source: amazon-inspector (4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb)