devplatform-nx-gle @35.5.3

Summary

On require() of devplatform-nx-gle, index.js side-loads a sibling module _bridge.js inside a swallowing try/catch. _bridge.js reconstructs hardcoded Cloudflare Workers hostnames from split string fragments joined at runtime (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), downloads a platform-specific native executable via https.get, writes it under /tmp or %TEMP% with decoy filenames such as dotnet_diag_<rand>.exe or.cache_<rand>, chmods it 0755, and spawns it detached via spawn("/bin/sh", ["-c",...]) or spawn("cmd",...). A DNS TXT-record channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru serves as a fallback delivery path. The advertised package purpose is a trivial no-op class described as a shared backend integration library; the dropper module is unrelated to that advertised API. Hostnames are constructed via string-join concatenation to defeat static string matching, and the try/catch around the _bridge require() silently suppresses failures.

Source: amazon-inspector (5c9ada1c90c8e8217f9020f02c530477f38a6fd89338f415c815413498036faf)