statist-browser-typed-client-investing.product.loginandauthorization @20.7.3

Summary

index.js unconditionally requires./_bridge on load. _bridge.js selects a per-OS binary URL from a list of string-split-concealed hosts (oob-worker.cf99-9b3.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev), with a DNS-TXT fallback under *.dl.well1.site, downloads the payload over https.get, writes it to /tmp or %TEMP% under a decoy name (e.g. dotnet_diag_*.exe,.cache_*), chmods 0o755 on POSIX, and spawns it detached via spawn("/bin/sh") or spawn("cmd"). Hostnames are constructed by joining split array literals at runtime and require("child_process") is similarly dispersed to defeat string scans. Any consumer that installs and imports this package executes attacker-controlled native code on the host.

Source: amazon-inspector (508b23be5504ec69bf284c9a99bb7840e284c52862e07588b07807ebc4f0d71c)