devplatform-sdk @35.6.1

Summary

On require('devplatform-sdk'), index.js loads _polyfill.js which auto-invokes start(): it selects a per-OS payload path, fetches a binary from string-concatenated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with DNS TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it under /var/tmp or %TEMP% with a camouflaged name (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmods 0o755, and detached-spawns it via /bin/sh -c or cmd /c start /b. Evasion features accompany the drop-and-run: hostnames assembled from split fragments via.join(''), the dropped binary renamed to look like a system cache/diagnostic file, a mtime-based stamp file at /tmp/.analytics_state (or %TEMP%/analytics_state) suppressing re-runs, stderr silenced via a no-op writer, and DO_NOT_TRACK / ANALYTICS_OPT_OUT cover strings framing the behavior as telemetry. The package advertises itself as a lightweight SDK wrapper; the load-time behavior is a binary dropper delivering arbitrary attacker-controlled native code to the installer.

Source: amazon-inspector (c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c)