fry-page-maker-types @20.6.4

Summary

On require() of the package, index.js loads _bootstrap.js, which selects a platform-specific payload (linux_x64, linux_arm64, darwin, win32), downloads it from Cloudflare Workers hosts whose names are reconstructed at runtime from split string fragments (e.g. oob-worker.cf100-416.workers.dev and sibling cf102-baf/cf103-070/cf99-9b3.workers.dev), with a DNS TXT-record covert-channel fallback via *.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names mimicking legitimate OS artifacts (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A marker file.analytics_state is dropped alongside. Host names and endpoints are split-string obfuscated to evade static analysis. Simply importing this package as a library causes remote code execution on the installer's machine with the installer's privileges.

Source: amazon-inspector (aa133d7d2ce61c2b2b4d2c48beec5e819a49b52349f7f0b212e446a667457ea7)