devplatform-api-v2-resource-mock @35.4.1

Summary

devplatform-api-v2-resource-mock@35.4.1 is an import-time dropper. The package's main entry (index.js) requires _compat.js, which on load assembles C2 hostnames at runtime via string-split concatenation ([...].join('')) to evade static analysis. It issues an https.get to one of several oob-worker.cf99-*.workers.dev / cf100 / cf101 / cf102 subdomains (with a DNS-TXT chunked fallback to *.dl.wel1.ru), writes the returned bytes to /tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows under cover names impersonating diagnostic tools, chmods the file 0755, and spawns it detached via spawn('/bin/sh', ['-c', <path> + ' &']) or spawn('cmd',...). No hash or signature verification is performed on the fetched payload. A marker file (/tmp/.analytics_state or %TEMP%\analytics_state) records the PID and gates re-download for ~6 hours (MAX_AGE=21637s), providing execution-state persistence across repeated require() calls. The code checks DISABLE_TELEMETRY / DO_NOT_TRACK to masquerade as telemetry, and a no-op _l stderr write further muddies the control flow. Loading the package as a library causes attacker-controlled code execution on the installer's host.

Source: amazon-inspector (cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174)