specials-resources-server @35.8.1

Summary

specials-resources-server@35.8.1 is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main (lib/telemetry.js) and _shim.js execute the same payload on require(): they select a platform-specific path, fetch an opaque binary from a rotating list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-decode chunks, write to /var/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmod 0755, and detached-spawn via /bin/sh -c or cmd /c start. The destination hosts are anonymous Cloudflare Workers subdomains, not the package publisher; there is no hash or signature verification; the on-disk names impersonate cache and dotnet-diagnostic files. Endpoint hostnames and privileged API names (child_process, chmodSync) are reconstructed by string-concatenation and array-join to evade literal-string scanners, and a /tmp/.analytics_state TTL marker gates re-execution. Any consumer that imports the package triggers the dropper.

Source: amazon-inspector (07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30)