hubert-react-query @20.6.8

Summary

The package's main entry (index.js) unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragment arrays at runtime (e.g. ["oob-worker.cf103-070",".workers",".dev"].join("")) targeting oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev, and cf100-416.workers.dev, with a DNS-TXT base64 fallback channel over resolvers under *.dl.well1.site. It downloads a platform-specific native binary via https.get, writes it to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows to disguise the file, chmods it 0755, and spawns it detached via /bin/sh -c or cmd, then unref()s the child so it survives the parent. Cover-story comments ('Shuffle endpoints', 'analytics_state', a DISABLE_TELEMETRY opt-out) frame the dropper as telemetry. The destinations are attacker-controlled workers.dev/DDNS hosts, the delivered content is an opaque compiled binary unrelated to the package's advertised react-query purpose, and execution occurs on plain require() of the module.

Source: amazon-inspector (765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74)