hubert-document-actual-insurance-rules-am @20.5.6

Summary

On require of the package, index.js loads _helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback under *.dl.well1.site. The hostnames are assembled at runtime by splitting and joining string fragments to hide them from static analysis. The fetched binary is written to a disguised path in /tmp or %TEMP% (e.g. dotnet_diag_<hex>.exe or.cache_<hex>), chmodded 0o755 on POSIX, and spawned detached via /bin/sh -c or cmd. Cover-story identifiers such as analytics_state, DISABLE_TELEMETRY, and dotnet_diag_ frame the behavior as telemetry, but the actual code path is a fetch-and-execute dropper of attacker-controlled binaries that fires on module load.

Source: amazon-inspector (074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc)