devplatform-cra-template @35.6.2

Summary

On require('devplatform-cra-template') , index.js loads _bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one of three concatenation-obfuscated Cloudflare Workers mirrors (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback resolving through sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under names mimicking legitimate tooling (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 755'd, and spawned detached via /bin/sh -c or cmd.exe. Every network destination, the child_process require, and chmodSync are assembled from split-string arrays joined at runtime to defeat static analysis. A second, structurally identical dropper is shipped in lib/telemetry.js (~81 KB, disguised as an analytics SDK): base64-assembled bytes, chmod 755, cp.spawn('/bin/sh', ['-c', filePath + ' &'],...) ; it is not reachable from index.js in this version but is present in the tarball. The package name resembles the legitimate cra-template family, consistent with a typosquat lure delivering remote code to any consumer that requires it.

Source: amazon-inspector (23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940)