cobrowsing-logger @35.7.7

Summary

index.js unconditionally requires _adapter.js on load. _adapter.js reconstructs destination hostnames from string-split fragments (assembling oob-worker.cf99-9b3.workers.dev , oob-worker.cf102-baf.workers.dev , oob-worker.cf103-070.workers.dev , oob-worker.cf100-416.workers.dev , and sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru at runtime), platform-branches on the host OS, downloads an opaque executable over HTTPS with a DNS-TXT base64 fallback under the *.dl.wel1.ru zone, writes it to /tmp or %TEMP% under a decoy filename ( .cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe . An opt-out branch is gated on generic-telemetry environment variables to mimic benign analytics behavior. The dropped binary is not shipped in the tarball and is not verified by hash or signature; whatever the operator of the Workers hosts / DNS-TXT channel serves at fetch time runs detached on the installer's machine on every require('cobrowsing-logger') .

Source: amazon-inspector (8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea)