claims-get-indexed-selector @35.8.7

Summary

claims-get-indexed-selector@35.8.7 executes a binary dropper on module load. index.js unconditionally requires _polyfill.js, which reassembles network destinations from split string arrays (hosts on cf*.workers.dev and *.dl.wel1.ru), downloads a native binary over HTTPS, writes it to /var/tmp/.cache_<hex> or TEMP\dotnet_diag_<hex>.exe with cover-story filenames, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS retrieval fails, a covert DNS-TXT channel is used: a chunk-count TXT record at c.<domain> and base64-encoded payload chunks at <i>.<domain> are fetched and reassembled into the executable. No hash or signature verification is performed on the fetched binary. Destination hostnames are constructed from split arrays such as ["oob-worker",".cf103-070.","workers.","de","v"].join("") to evade static string scanning. The package is presented as a benign runtime support module; the delivered binary is opaque and the destinations are attacker-controlled.

Source: amazon-inspector (fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35)