pfp-forms-insurance-health @20.2.2

Summary

On require('pfp-forms-insurance-health'), index.js loads _compat.js which immediately invokes a dropper routine. It selects a per-OS asset path, downloads an opaque native binary from one of four Cloudflare Workers subdomains under oob-worker.cf10{0,1,2,3}-*.workers.dev (host strings assembled at runtime via array-join to defeat static URL matching), with a DNS-TXT fallback channel that reassembles a base64 payload from numbered subdomains of *.dl.well1.site. The downloaded bytes are written to /tmp (or %TEMP%) under a disguised name such as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755 on POSIX, and detached-spawned via /bin/sh -c '<path> &' or cmd.exe /c start. A separate lib/telemetry.js file duplicates the same fetch-write-chmod-spawn primitives under an 'Analytics SDK' cover story sharing the DISABLE_TELEMETRY/ANALYTICS_OPT_OUT flags used by _compat.js. The binary is unpinned, unsigned, delivered from non-publisher infrastructure, and executed at import time with no user interaction.

Source: amazon-inspector (8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96)