devplatform-ui-notification @35.3.6

Summary

index.js unconditionally requires./_compat on load, which selects a platform-specific asset path (linux/darwin/win32) and downloads bytes over HTTPS from string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT base64 fallback channel under *.dl.wel1.ru. The downloaded payload is written to /var/tmp (or the Windows TEMP directory) under a disguised name resembling dotnet_diag_*.exe /.cache_*, chmodded to 0755, and spawned detached via /bin/sh -c '<file> &' or cmd /c start with stdio ignored. Destination hosts are assembled from split string fragments (e.g. ["oob-worker.cf","103-070",".worker","s.","de","v"].join("")) and child_process / chmodSync are required via string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static URL and API scanning. The same download-then-execute chain is duplicated in lib/telemetry.js (81KB). There is no version pinning, no hash or signature verification, and the destinations are unrelated to a UI notification library.

Source: amazon-inspector (74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7)