tcb-web-images @20.5.3

Summary

On require('tcb-web-images') , index.js loads _helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads a binary over HTTPS from one of four Cloudflare Workers hosts whose names are assembled at runtime by joining string-array fragments ( oob-worker.cf103-070.workers.dev , oob-worker.cf101-adf.workers.dev , oob-worker.cf100-416.workers.dev , oob-worker.cf99-9b3.workers.dev ), with a DNS-TXT chunked fallback under *.dl.well1.site . The downloaded bytes are written to /var/tmp or %TEMP% under disguised names mimicking system utilities ( .cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod'd 0755, and detach-spawned via /bin/sh -c '<path> &' or cmd.exe . A freshness marker is stored as .analytics_state and stderr is silenced by a no-op logger. A second, larger copy of the same dropper is shipped as lib/telemetry.js under an 'analytics SDK' cover story, using additional string-concatenation obfuscation ( require("child_" + "process") , fs["chmod"+"Sync"] ); it is not referenced by the current index.js but is bundled at the tarball root. The package is advertised as a 'lightweight images wrapper' — the dropper behavior is unrelated to that purpose, the destinations are author-controlled and obfuscated to defeat scanners, and the delivered bytes are an opaque native executable with no publisher provenance, integrity check, or version pinning.

Source: amazon-inspector (1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69)