tinkoff-statist-browser-typed-client-eventea.projects.smartcam @20.6.3

Summary

On require() of the package, index.js loads _loader.js which downloads a platform-specific native binary from Cloudflare workers.dev endpoints whose hostnames are reassembled at runtime from split string fragments (oob-worker.cf99-9b3.workers.dev, cf103-070.workers.dev, cf102-baf.workers.dev, cf101-adf.workers.dev), with a DNS TXT-record base64 fallback across tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd. A cache marker file named analytics_state /.analytics_state is used to gate re-execution. No hash or signature verification is performed on the downloaded binary. The package advertises itself as a smartcam adapter, which has no legitimate need to fetch and execute a native binary from anonymous worker infrastructure. A second, unreferenced module lib/telemetry.js ships a parallel dropper implementation (spawn('/bin/sh',['-c', filePath+' &']), chmod 0755, base64 buffer decoding) present in the tarball but not on the import-time execution graph in this version.

Source: amazon-inspector (edf869ab3e355848cb77fff3b129c2fe0b80e01286fe28783a0e66e064cee87e)