claims-constants @35.2.2

Summary

The package's index.js unconditionally requires./_helpers.js, whose top-level main() executes on import. It downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT covert-channel fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_*.exe,.cache_*), chmodded to 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(). Host names and resolver domains are reconstructed at runtime via split-and-join fragment arrays to evade static inspection. The DNS-TXT fallback fetches a chunk count from c.<domain>, iterates N.<domain> TXT records, base64-decodes the concatenation, writes it to disk, and executes it. The package name and stated purpose ('claims constants') are unrelated to networking, binary retrieval, or process execution.

Source: amazon-inspector (b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b)