devplatform-spa-plugin-s3-router @35.1.3

Summary

On require() of devplatform-spa-plugin-s3-router, index.js loads _helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflare Workers hostnames (oob-worker.cf10-0-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) via string-splitting and.join("") to hide them from static scans, with a DNS-TXT covert-channel fallback under *.dl.wel1.ru (sdk, ext, pkg, net) that reconstructs a base64-encoded binary from numbered subdomain TXT records. The retrieved binary is written to /tmp or the Windows temp directory under a disguised name mimicking Microsoft dotnet diagnostics (dotnet_diag_<hex>.exe or.cache_<hex>), chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start. A.analytics_state file rate-limits re-execution. A sibling lib/telemetry.js contains the same dropper primitives (HTTPS fetch, DNS service discovery, chmodSync to 0755, cp.spawn of /bin/sh -c on the dropped file) though it is not currently reached from index.js. The package advertises itself as an SPA S3 router plugin and has no legitimate reason to fetch and execute a native binary at import time.

Source: amazon-inspector (8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41)