checkout-resend-pos-order-sms-am @35.3.3

Summary

On require() of this package, index.js loads _polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation (e.g. 'oob-worker.cf10x-*.workers.dev' variants) and issues an https.get to download a platform-specific executable. The bytes are written to /var/tmp/.cache_<rnd> on Unix or %TEMP%\dotnet_diag_<rnd>.exe on Windows, chmodded to 0755, and spawned detached via spawn('/bin/sh', ['-c', <path> + ' &']) or the Windows equivalent. A DNS-TXT base64-chunk fallback via *.dl.wel1.ru resolvers is used when direct HTTPS fetch fails. The child_process module reference and 'chmodSync' string are also concatenated at runtime ('child_'+'process', 'chmod'+'Sync') to defeat static string matching. A sibling module lib/telemetry.js contains the same fetch/chmod-0755/sh-c-spawn dropper pattern, indicating shared payload infrastructure. The package's stated purpose (an SMS/POS order helper) is unrelated to downloading and executing native binaries from Cloudflare Workers subdomains, and the disguised on-disk filenames (.cache_*, dotnet_diag_*.exe) further indicate concealment rather than legitimate runtime setup.

Source: amazon-inspector (67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11)