statist-browser-typed-client-sme.rko.tariffs.web @20.3.8

Summary

On require() of this package, index.js loads _compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of three string-obfuscated *.workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), and falls back to a DNS TXT covert channel on *.dl.well1.site (tin/tina/ldr/win.dl.well1.site) if HTTPS fails. The fetched bytes are written to a temp file with a cover-story name (dotnet_diag_*.exe on Windows, /var/tmp/.cache_* on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. C2 hostnames are assembled at runtime from split-string arrays joined with '' to evade static analysis. There is no signature or hash verification, and the fetched binary is unrelated to the package's stated 'web adapter' purpose. A cooldown marker is written to suppress re-execution.

Source: amazon-inspector (d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067)