devplatform-spa-plugin-cobrowsing @35.4.4

Summary

On require() of the package, index.js loads _runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscated Cloudflare Workers hosts (hostnames assembled at runtime via array-join, e.g. 'oob-worker.cf<NNN>-<hex>.workers.dev'), with a DNS TXT-record fallback channel under 'c.<domain>' / 'N.<domain>' that returns base64-encoded chunks decoded into the payload. The downloaded bytes are written to /tmp/.cache_<rand> (chmod 0755) on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, and spawned detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}).unref() or a cmd equivalent. Destinations are unrelated to the package's stated cobrowsing purpose, hostnames are obfuscated to defeat static analysis, and the payload is executed with no integrity check.

Source: amazon-inspector (96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e)