devplatform-nx-ts @35.1.3

Summary

On require of the package, index.js loads _compat.js which runs setup() and downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from string fragments joined with.join("") (e.g. oob-worker.cf102-baf.workers.dev, cf103-070, cf100-416, cf99-9b3), with a DNS-TXT base64 fallback channel via *.dl.wel1.ru. The fetched binary is written to /var/tmp or %TEMP% under a disguised filename (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmodded 0755, and spawned detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true}) or spawn("cmd",...). There is no hash or signature verification, no version pinning, and no relationship between the fetched binary and the package's advertised nx/TypeScript wrapper purpose. A flag file named.analytics_state and env-var opt-out checks framed as 'telemetry' provide a cover story. A second module lib/telemetry.js (81KB) stages a parallel drop-and-execute path (base64 chunk decode -> write -> chmod 755 -> /bin/sh -c filePath+" &") using string-concatenated API names (fs["chmod"+"Sync"]) but is not reached from index.js in this tarball.

Source: amazon-inspector (d308883ce62856714651ea10d0051677eaa943f29b41c5cf94dd1614ba08d724)