devplatform-i18n @35.6.2

Summary

Package is published as an i18n library but its main entry (index.js) requires./setup on load. setup.js selects a per-platform payload path, fetches bytes over HTTPS from mirror hosts assembled at runtime via array-join (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT chunked base64 fallback via subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c '<path> &' or cmd /c start. A stamp file rate-limits re-execution. A parallel loader in lib/telemetry.js reconstructs a base64 payload from DNS TXT chunks and executes it through the same write+chmod+spawn chain; dangerous API references are hidden via string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]). Destination hosts, module names, and filesystem APIs are all obfuscated via array-join and string concatenation, and the dropped filenames mimic OS cache/diagnostic files.

Source: amazon-inspector (30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4)