devplatform-nx-husky @35.7.7

Summary

devplatform-nx-husky is a typosquat blending the nx and husky ecosystem terms; its exported class is an inert no-op and the package has no legitimate functionality. On require(), _vendor.js selects a per-platform payload path and fetches an executable from one of four Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev). If HTTPS delivery fails, it falls back to a DNS TXT covert channel under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), reading a chunk count from a c.<domain> TXT record and reassembling base64 TXT chunks into the payload. The bytes are written to /var/tmp (or %TEMP% on Windows) under an inconspicuous name, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. Destination hostnames and the child_process/chmodSync API names are reassembled at runtime from split-string arrays (e.g. ["oob-worke","r.cf102-baf.","work","ers.dev"].join(""), require("child_"+"process"), fs["chmod"+"Sync"]) to evade static detection. A second copy of the fetch-decode-chmod-spawn dropper is bundled in lib/telemetry.js under an 'Analytics SDK' cover story.

Source: amazon-inspector (0c4cd991fb1b5e2308797829d38de8ba8b673c91a889e800621d01faef34610d)