fb-hr-sites--boxified-form-meetup-subcribe @20.6.4

Summary

The package's index.js exports an inert class and silently require()s./_platform inside a swallowed try/catch. On load, _platform.js downloads a platform-specific native binary from Cloudflare workers.dev hostnames assembled by joining split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT fallback pointing at *.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755, and executed detached via spawn('/bin/sh', ['-c', path+' &']) on Unix or cmd.exe /c start /b on Windows. Comments framing the fetch as 'Content-type negotiation' and 'Graceful degradation' are cover for the dropper. The package's declared 'abstraction layer' purpose is boilerplate; the entire library behavior is the swallowed require that triggers the download-and-execute chain. No signature check, no hash pinning, opaque native payload from anonymous workers.dev infrastructure.

Source: amazon-inspector (b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07)