statist-browser-typed-client-ddp.mentat.ui.web @20.9.4

Summary

The package's main entry (index.js) loads _polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from one of four obfuscated destinations whose hostnames are assembled at runtime via string-fragment .join("") calls (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), writes the payload to /tmp or the Windows TEMP directory under disguised names such as dotnet_diag_<hex>.exe or .cache_<hex> , chmods it to 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() . A DNS-based fallback channel reconstructs the payload by concatenating base64-encoded TXT records under numbered subdomains of dl.well1.site (tin, tina, ldr, win). A second parallel dropper implementation ships in lib/telemetry.js under an "analytics SDK" cover story, using require("child_"+"process") and fs["chmod"+"Sync"] string-splits to evade scanners. Any consumer that requires this package triggers download and detached execution of an opaque attacker-controlled native binary on the host.

Source: amazon-inspector (0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7)