devplatform-auth-client @35.2.1

Summary

Requiring devplatform-auth-client loads _bootstrap.js , which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded Cloudflare workers.dev subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-based fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes them to /tmp or %TEMP% under decoy names such as .cache_<hex> and dotnet_diag_<hex>.exe , chmods 0755, and spawns them detached via /bin/sh -c or cmd . The destination hostnames and dangerous API names are assembled from split-string fragments joined at runtime to evade static scanners. A sibling lib/telemetry.js module, presented as an analytics SDK, contains a parallel loader that base64-decodes a payload, dynamically resolves chmodSync , and spawns the decoded file. The fetched bytes are unpinned, unverified, and unrelated to any documented publisher.

Source: amazon-inspector (3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626)