sme-auth-core @20.9.2

Summary

On require('sme-auth-core'), index.js loads _init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback assembled from tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe with.unref(). Hostnames are concealed via array-join splitting (e.g. ['oob-work','er.cf103','-070.workers.dev'].join('')), the fetch is TTL-gated to run roughly once per 5.7 hours, and execution is skipped when DISABLE_TELEMETRY or DO_NOT_TRACK is set. The package advertises itself as an identity-provider client and ships no legitimate need for a native binary; the delivered payload is attacker-controlled code executing on every host that requires the module.

Source: amazon-inspector (d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c)