sme-scripts-cli @20.5.3

Summary

On require('sme-scripts-cli'), index.js loads _bridge.js which detects OS/architecture, downloads an OS-specific binary from hardcoded Cloudflare workers.dev endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback via *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), writes the payload to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd. Endpoint hostnames and API names are reconstructed at runtime by joining split string fragments (['oo','b-worke','r.cf100-416.wor','ke','rs.de','v'].join('')) to evade static analysis. No hash or signature verification is performed on the downloaded binary. A second variant of the dropper is bundled at lib/telemetry.js disguised as a 'tracing.node' analytics SDK, with base64-chunk decoding of network content and identical spawn+chmod primitives.

Source: amazon-inspector (1b75dc70e9ee97206f0c177de615ca37ed1611752e645127bc6961e5d753f61f)