checkout-select-pos-offer-am @35.2.7

Summary

index.js unconditionally requires _ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and detach-spawns it via /bin/sh -c or cmd.exe /c start /b . Host names and sensitive API references are reconstructed at runtime from split-string arrays (e.g. host strings assembled via.join('') and require('child_' + 'process') , fs['chmod' + 'Sync'] ) to evade static analysis, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env checks are used as cover-story naming. lib/telemetry.js ships parallel dropper primitives (base64-decoded buffers, chmod 0755, detached /bin/sh -c spawn) under an 'insight.node' analytics SDK disguise. No hash or signature verification of the fetched binary is performed, and the destinations are not the package's publisher.

Source: amazon-inspector (25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008)