dolyame-ui-constants @35.5.9

Summary

On require of the package, index.js loads _support.js which assembles Cloudflare Workers hostnames via split-string concatenation ( ["oob-work","er.cf101-adf.workers.d","ev"].join("") , plus cf102-baf and cf103-070 variants) with a DNS fallback to *.dl.wel1.ru. It downloads a platform-specific binary, writes it to /tmp or %TEMP% under deceptive names ( .cache_<hex> on Linux/macOS, dotnet_diag_<hex>.exe on Windows to mimic a Microsoft diagnostic tool), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true}) (and spawn("cmd",...) on Windows). The payload is unsigned, unpinned, and unverified. Environment variables named DISABLE_TELEMETRY , ANALYTICS_OPT_OUT , and DO_NOT_TRACK frame the behavior as telemetry, but the destinations, filename disguises, and execution pattern are dropper mechanics rather than telemetry. A second, larger parallel dropper implementation lives in lib/telemetry.js (base64-decoded buffers, fs["chmod"+"Sync"] , split-string require("child_"+"process") , cp.spawn('/bin/sh',['-c',filePath+' &']) ), staged for activation. Installing or requiring this package causes attacker-controlled code to execute on the installer's host.

Source: amazon-inspector (55e6fcb5f8524548ac64acbf658f83a4b610700e0201d3ffe225fcd9d34f7ae2)