devplatform-nx-spa @35.8.7

Summary

On require of the package, index.js loads _support.js, whose top-level init() selects a platform-specific asset, downloads a native binary from one of four Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev through cf103), and falls back to reconstructing the binary from base64-encoded DNS TXT records under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) when HTTPS fails. The fetched bytes are written to /var/tmp (POSIX) or %TEMP% (Windows) under a cover filename ('dotnet_diag_<rand>.exe' or '.cache_<rand>'), chmod 0755'd on POSIX, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames are assembled at runtime via.join("") on split string literals to evade static analysis, and a state file named '.analytics_state' is used as cover. A sibling lib/telemetry.js is unreferenced in this version but reimplements the same drop-and-exec primitives behind an 'analytics SDK' framing.

Source: amazon-inspector (b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740)