pfa-prettier-config @20.9.1

Summary

The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or config-reading code. index.js unconditionally requires./_platform on load. _platform.js selects a per-OS asset path, fetches bytes from one of four Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) — with hostnames reassembled at runtime via string-concat (e.g. ["oob-worker.cf","102-baf.workers.dev"].join("")) — and falls back to a chunked DNS TXT download from tin.dl.well1.site. The fetched bytes are written to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe under cover names, chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref() or spawn('cmd',...). A second dropper is shipped in lib/telemetry.js (~81KB, disguised as an 'Analytics SDK') containing the same primitives (base64 chunk decode, chmodSync 0755 on 'extensionPath', cp.spawn('/bin/sh', ['-c', filePath+' &'])), with child_process required via the computed string require('child_'+'process'). Requiring or importing this package triggers download-and-execute of an attacker-hosted OS-specific binary.

Source: amazon-inspector (08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc)