checkout-commit-pos-order-am @35.8.4

Summary

checkout-commit-pos-order-am@35.8.4 executes a dropper on module load. Its main entry index.js requires _shim.js , which selects a platform-specific asset path and downloads an opaque native binary over HTTPS from hardcoded oob-worker.cf102-baf.workers.dev , oob-worker.cf99-9b3.workers.dev , and oob-worker.cf103-070.workers.dev hosts, with a DNS TXT-record fallback that reassembles base64 chunks from sdk.dl.wel1.ru , ext.dl.wel1.ru , pkg.dl.wel1.ru , and net.dl.wel1.ru . Destination hostnames and the child_process require are built at runtime by joining fragmented substrings to evade static scanners. The downloaded bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows (disguised filenames), chmod 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b . A parallel dropper with the same download-chmod-spawn shape is bundled as lib/telemetry.js (~81KB) under an analytics-SDK cover story and is not currently wired from the entry points but ships in the tarball.

Source: amazon-inspector (732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8)