tinkoff-statist-web-typed-client-test.golden.retriever @20.4.4

Summary

On require() of the package, index.js loads _init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation (four oob-worker.cf*.workers.dev hosts plus a DNS-TXT base64 fallback under *.dl.well1.site), downloads a platform-specific native binary, writes it to /var/tmp or %TEMP% under deceptive names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A second, parallel downloader-and-launcher wrapped in a fake 'Analytics SDK' cover story is shipped in lib/telemetry.js (ServiceDiscovery over DNS, WorkerHost spawning /bin/sh with base64-decoded chunks). Endpoint hostnames, sensitive API names ( chmod + Sync , require('child_'+'process') , _p('platform') ) are reconstructed at runtime to evade static inspection. Require()ing the package yields arbitrary attacker code execution on the installer host.

Source: amazon-inspector (352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a)