devplatform-spa-ui @35.8.2

Summary

On require, _vendor.js selects a per-OS payload URL, fetches a binary from rotating *.workers.dev hosts (with a DNS-TXT base64 fallback via *.dl.wel1.ru ), writes it to a hidden temp path ( .cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) or the Windows equivalent. Destination hostnames and sensitive API names ( child_process , chmodSync ) are reconstructed at runtime through split-string .join('') concatenation to evade scanners. lib/telemetry.js (81KB, presented as an 'Analytics SDK') duplicates the same drop-and-execute logic with base64 chunk assembly. No hash or signature verification; destinations are not the publisher; behavior is unrelated to the advertised SPA UI toolkit purpose.

Source: amazon-inspector (fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428)