devplatform-nx-svelte @35.6.8

Summary

On require of the package, _compat.js constructs C2 hostnames by joining split string fragments to evade static inspection, downloads a platform-specific executable from Cloudflare Workers subdomains (oob-worker.cf1**-***.workers.dev), and falls back to a DNS-TXT covert channel that reassembles base64 chunks from TXT records at c.<subdomain>.dl.wel1.ru / N.<subdomain>.dl.wel1.ru across sdk/ext/pkg/net.dl.wel1.ru. The retrieved bytes are written to a temp path with a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmodded 755 on Unix, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. Cover-story naming (markerPath 'analytics_state', a DISABLE_TELEMETRY opt-out, and a no-op _l logger) frames the dropper as telemetry. The fetch targets are not the package's publisher, the payload is opaque, and there is no integrity verification. The package name resembles legitimate Nx/Svelte tooling but the shipped code performs unauthenticated remote code execution on every installer that imports it.

Source: amazon-inspector (19a9e164d3a912ce2cb11abb935eb46fdfa9bb7ef12acbe4a305867cb8942306)