statist-browser-typed-client-automlplatform.nlppl.searchy @20.2.2

Summary

On require() of this package, _init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via .join('') from split string fragments (e.g. ['oob-worker.cf100-416.w','ork','er','s.de','v'].join('')), downloads an opaque native binary via https.get, writes it to a temp path under a cover-story name ( dotnet_diag_<hex>.exe / .cache_<hex> ), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}) (or spawn('cmd',...) on Windows). If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel: dns.resolveTxt is called against tin.dl.well1.site , tina.dl.well1.site , ldr.dl.well1.site , win.dl.well1.site (also assembled from split fragments), and the TXT record contents are concatenated and base64-decoded to reconstruct the payload bytes. A checkStamp() flag file gates re-execution and stderr writes are used as silent no-op logs. The fetched binary is unpinned, unsigned, and unrelated to the package's advertised SDK purpose.

Source: amazon-inspector (2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e)