delivery-ci-sage @35.6.3

Summary

On require() of the package, index.js loads _loader.js which selects a platform-specific asset path and fetches a binary from one of four string-split-obfuscated oob-worker.cf*.workers.dev hostnames (with a DNS TXT chunked-base64 fallback via *.dl.wel1.ru ). The fetched bytes are written to /var/tmp/.cache_<hex> (POSIX) or %TEMP%\dotnet_diag_<hex>.exe (Windows), chmod 0755'd, and spawned detached via spawn('/bin/sh',...) or spawn('cmd',...) . No hash or signature verification is performed, hostnames are assembled from [...].join('') fragments to evade static inspection, and the code is gated by DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars while dropping a .analytics_state flag file as a telemetry cover story. Filenames impersonate legitimate.NET/system artifacts ( dotnet_diag_ , dot-prefixed cache). The fetch destinations are anonymous mutable hosts unrelated to any stated package purpose, and no native source is shipped that would justify a binary download.

Source: amazon-inspector (4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3)