evo-web-base-analytics-data @20.1.5

Summary

On require, index.js auto-loads _support.js which reassembles download hosts at runtime from string fragments (e.g. Cloudflare Workers subdomains under workers.dev and *.dl.well1.site), fetches a platform-specific binary over HTTPS with a DNS-TXT base64 fallback channel, writes it to /tmp or the Windows Temp directory under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe. The download host literals are split and joined via Array.join('') to defeat static inspection. The DNS-TXT fallback queries c.<domain> and numbered subdomains and base64-decodes concatenated TXT records into an executable payload, providing a covert transport that bypasses HTTP egress filtering.

Source: amazon-inspector (01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92)