peter-desktop-peter-big-column @20.3.2

Summary

On require(), index.js loads _runtime.js which assembles download hostnames at runtime from split string fragments (resolving to oob-worker.cf99-9b3.workers.dev and *.dl.well1.site) and fetches a platform-specific binary via HTTPS with a DNS TXT fallback channel. The retrieved bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755 is applied on POSIX, and the binary is spawned detached via /bin/sh -c '<path> &' or cmd /c start. A deduplication lockfile is disguised as an analytics stamp. lib/telemetry.js ships a second copy of the same fetch-write-chmod-spawn dropper under an 'apm.node' SDK guise. The delivered binary is attacker-controlled and opaque; string-array hostname assembly hides the destinations from static inspection.

Source: amazon-inspector (7593cd2f0f03765e6debc06626ee5d771a32e0d7eb579ddca1bfc5ca53bc22e6)