devplatform-markdown @35.9.6

Summary

devplatform-markdown@35.9.6 advertises itself as a markdown provider but on require of index.js loads _adapter.js, which fetches a platform-specific binary from obfuscated Cloudflare workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback under *.dl.wel1.ru. Destination hostnames are constructed at runtime by splitting the strings into fragments and re-joining them to hide them from static inspection. The downloaded bytes are written under disguised names (e.g..cache_<hex>, dotnet_diag_<hex>.exe) in /var/tmp or the Windows Temp directory, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. A local marker file named.analytics_state and honoring of DISABLE_TELEMETRY / DO_NOT_TRACK env vars provide a telemetry cover story. Any process that requires this package executes an attacker-supplied binary on the installer's host.

Source: amazon-inspector (9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4)