devplatform-react-micro-frontend @35.2.1

Summary

devplatform-react-micro-frontend@35.2.1 is a lure package whose main entry auto-loads _adapter.js on require. _adapter.js selects a platform-specific asset, downloads an opaque binary over HTTPS from a rotating list of Cloudflare *.workers.dev hosts (oob-worker.cf101-adf.workers.dev and siblings cf100/cf102/cf103), and if HTTPS fails reassembles up to 2000 numbered TXT records under *.dl.wel1.ru into a base64 payload. The bytes are written to a temp path under a masquerading name (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 755 on POSIX, and spawned detached via /bin/sh -c or cmd. Network destinations are assembled by joining substring arrays (e.g. ["oob-worker.cf101-a","df.workers.","dev"].join(""), ['sdk.dl.w','el1.','ru'].join("")) to evade static analysis. A duplicate dropper is shipped as lib/telemetry.js framed as an "Analytics SDK", using string-concat obfuscation of require("child_"+"process") and fs["chmod"+"Sync"] to reach the same write-chmod-spawn sink. Installing or requiring the package results in remote-controlled binary execution on the host.

Source: amazon-inspector (38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475)