devplatform-create-nx-spa @35.4.9

Summary

devplatform-create-nx-spa@35.4.9 ships an index.js main entry that silently require() s _bridge.js , which on load assembles Cloudflare Workers hostnames ( oob-worker.cf10{0,1,2,3}-*.workers.dev ) and a fallback DNS-TXT channel to *.dl.wel1.ru from split-string arrays joined at runtime, downloads an unsigned opaque binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755 s it, and spawns it detached via spawn('/bin/sh', ['-c', <path>+' &'], {detached:true}) or spawn('cmd',...) . The behavior is disguised as "analytics" and gated by an /tmp/.analytics_state timestamp. The child_process identifier and destination hostnames are assembled from 3-4 substring pieces ( ['oob-worker.cf103-070.wor','ke','rs.dev'].join('') , require('child_'+'process') ) to defeat static string matching. The package presents itself as a lightweight Nx SPA scaffolder, but its main module's only load-time effect is to fetch and execute attacker-controlled code on the installer's host.

Source: amazon-inspector (6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464)