statist-browser-typed-client-mb.product.payments @20.1.9

Summary

On require() of the package, index.js loads _bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), and, if HTTPS mirrors fail, retrieves base64-encoded bytes over DNS TXT records under *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) and reassembles them. The fetched bytes are written to a temp file with deceptive names (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmodded 0755, and spawned detached/unref'd via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification, the destination hosts are unrelated to the package's advertised 'payments' purpose, hostnames are reconstructed at runtime to hide them from plain-text inspection, and the DNS-TXT channel is a covert egress-bypass mechanism. The package name resembles a scoped internal 'browser-typed-client' payment module, but the shipped behavior is a native dropper.

Source: amazon-inspector (61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843)