pfp-integration-mobile-heading @20.7.1

Summary

On require() of the package, _bootstrap.js selects a platform-specific binary path, downloads an opaque executable over HTTPS from a rotating list of Cloudflare Workers hosts (oob-worker.cf*.workers.dev, assembled from string-split fragments to evade static analysis), and falls back to a DNS-TXT covert channel across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site that reassembles a base64-encoded payload from numbered TXT records. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe,.analytics_state), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames are obfuscated with array.join, filenames impersonate dotnet diagnostics and analytics state, and DISABLE_TELEMETRY / DO_NOT_TRACK env vars gate execution as a benign cover story. The package advertises 'device integration' but performs none of that on load; the sole import-time behavior is retrieving and executing an attacker-controlled binary.

Source: amazon-inspector (b3428631054a61f4fd2a14f372d7c782dd08633446897b0ee0959d259496d170)