checkout-accounts-holder @35.2.3

Summary

On require('checkout-accounts-holder') , index.js loads _platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames assembled at runtime via .join("") over split string fragments (resolving to oob-worker.cf100-416.workers.dev with a DNS TXT fallback under sdk.dl.wel1.ru ), writes the opaque payload to /tmp or %TEMP% under cover names such as .cache_<rand> and dotnet_diag_<rand>.exe , chmods it 0o755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start . The module presents itself as analytics_state /telemetry. A second dropper of the same shape ships in lib/telemetry.js (base64-chunked payload, fs["chmod"+"Sync"] , require("child_"+"process") , spawn("/bin/sh", ["-c", filePath + " &"]) ), currently unreferenced but present in the published tarball. Destination hostnames are string-split to evade plain-text scanners, and the run-write-chmod-spawn chain executes attacker-controlled bytes with the installer's privileges.

Source: amazon-inspector (cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a)