pfp-forms-sme-registration-ooo @20.2.1

Summary

On require of pfp-forms-sme-registration-ooo, index.js loads _polyfill.js which selects a platform-specific asset path and fetches a native binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev) and *.dl.well1.site subdomains (tin, tina, ldr, win). The destination hostnames are reconstructed at runtime by joining split string arrays to evade static inspection, and a DNS-TXT chunked fallback channel is present. The fetched bytes are written to disguised paths (/var/tmp/.cache_<hex> on POSIX, %TEMP%/dotnet_diag_<hex>.exe on Windows), made executable via fs.chmodSync(outPath, 0o755), and spawned detached through /bin/sh -c or cmd.exe /c start /b. The binary is unpinned and unverified (no hash or signature check), the package's advertised purpose does not require a native helper, and the opt-out relies on generic environment variable names. Installing or importing this package results in arbitrary attacker-controlled code executing on the installer's host.

Source: amazon-inspector (d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648)