devplatform-sre-devplatform-sre-core @35.1.8

Summary

On require() of this package, index.js loads _helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) whose hostnames are reconstructed at runtime via array.join("") to evade static analysis. The binary is written to /tmp or the Windows Temp directory under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755'd, and spawn-detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A DNS-TXT covert-channel fallback under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) reassembles the payload from base64-encoded TXT records (count record c.<domain>, chunk records i.<domain>) when HTTPS delivery fails, then writes and executes the same way. A lockfile named.analytics_state and dotnet_diag-style filenames provide the cover story. This grants full remote code execution to whoever controls those endpoints on any machine that installs or imports the package.

Source: amazon-inspector (90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8)