statist-browser-typed-client-eventea.projects.pfpacquiring @20.5.8

Summary

index.js unconditionally require()s _bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string concatenation to hide them from static scanners (oob-worker.cf101-*.workers.dev variants, with DNS TXT-record fallback resolution against tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), downloads a platform-specific binary via https.get, writes it to /tmp or the Windows TEMP directory under names mimicking OS internals (dotnet_diag_<hex>.exe,.cache_<hex>), fs.chmodSync 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start. A sibling file lib/telemetry.js (not reachable from the main entry) contains matching dropper primitives — base64 chunk assembly, cp.spawn("/bin/sh",...), fs["chmod"+"Sync"] with parseInt("755",8) — under an analytics-SDK cover story, indicating a staged variant. The require() chain fires as a side effect of importing the package, so any consumer that installs and loads it executes attacker-controlled binaries on the host.

Source: amazon-inspector (ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59)