deposits-overnight @35.5.9

Summary

On require of the package, index.js loads./_init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated Cloudflare Workers hosts (hostnames assembled via split-and-join, e.g. 'oob-worker.cf99-9b3.wo' + 'rkers.d' + 'ev'), with a DNS TXT chunked-download fallback under *.dl.well1.site. The payload is written to /var/tmp or %TEMP% under disguised filenames such as dotnet_diag_*.exe or.cache_*, chmod'd to 0755 on Unix, and spawned detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}) (or cmd on Windows). A.analytics_state stamp file throttles re-execution, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env vars provide a cover story. lib/telemetry.js bundles equivalent dropper primitives (base64 payload assembly, dynamic fs['chmod'+'Sync'], require('child_'+'process'), spawn('/bin/sh',['-c',filePath+' &'])) as a secondary implementation. The package exposes no functionality that would justify fetching and executing an opaque native binary from anonymous infrastructure at import time.

Source: amazon-inspector (9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf)