pfa-errors @20.4.9

Summary

On require('pfa-errors'), index.js unconditionally loads _runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded Cloudflare workers.dev endpoints (oob-worker.cf100-416.workers.dev and siblings), writes it to a temp path with a decoy name (.cache_<hex> or dotnet_diag_<hex>.exe), sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe. When HTTPS is unavailable, a DNS-TXT covert channel to *.dl.well1.site reconstructs the binary from base64 chunks. Destination hostnames and sensitive API names such as child_process and chmodSync are fragmented into arrays and reassembled with.join('') at runtime to evade static string search. A second, functionally identical dropper shipped in lib/telemetry.js is not reached from index.js but embeds the same fetch+chmod+spawn primitives.

Source: amazon-inspector (9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f)