devplatform-cli-plugin-lint @35.5.1

Summary

On require() of the package, index.js loads _bootstrap.js which selects a platform-specific asset path (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary over HTTPS from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS-TXT fallback channel resolving *.dl.wel1.ru hosts (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp or %TEMP% under a randomized name such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe. Hostnames and dangerous API names (child_process, chmodSync) are reconstructed from split-string arrays via Array.join('') to evade static analysis. A secondary module lib/telemetry.js (81 KB) ships the same drop-and-execute primitives (base64 buffer decode, fs.chmodSync 0755, cp.spawn('/bin/sh', ['-c', filePath+' &'])) behind an 'analytics SDK' cover story. The package presents itself as a devplatform CLI lint plugin; the shipped code performs full-host remote code execution on library load.

Source: amazon-inspector (e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea)