vvvedernikov-test-another-test @20.2.6

Summary

On require of the package, index.js loads _bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS TXT fallback over subdomains of dl.well1.site (tin/tina/ldr/win), writes the payload to a randomized path under /var/tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmods it 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames are assembled at runtime via array-join and require("child_"+"process") to evade static inspection, with an install-once stamp at /tmp/.analytics_state and cover-story naming ('analytics', 'telemetry', 'dotnet_diag'). A second copy of the drop-and-exec primitives (base64 buffer decode, chmodSync 0o755, /bin/sh -c spawn) is shipped in lib/telemetry.js framed as an 'Analytics SDK'.

Source: amazon-inspector (69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83)