devplatform-ui-kit @35.6.2

Summary

Package advertised as a UI toolkit but on module load (index.js require()s _adapter.js) fetches an opaque platform-specific binary from obfuscated *.workers.dev hosts, with a DNS-TXT covert-channel fallback that reassembles base64 chunks from subdomains under dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). Host strings are constructed at runtime by joining short fragments (e.g. ["oob-work","er.cf102-baf.workers.de","v"].join("")) to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under disguise names such as dotnet_diag_*.exe /.cache_*, chmodded 0755 on POSIX, and spawned detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true}).unref() (cmd on Windows). No hash or signature verification. Behavior fires on any require()/import of the package, executing attacker-controlled code on the installer's machine.

Source: amazon-inspector (970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc)