MAL-2026-12273

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (698cb702f4e52ddb67226e8681dc3a11228f43cd11b47516329e16b8ae3de436)

The package typosquats an internal Tinkoff scope name. On require(), index.js loads init.js, which builds attacker hostnames at runtime from string-fragment arrays joined via.join("") (e.g., ["oob-wor","ker.cf100","-416.wor","kers",".dev"].join("")), downloads an opaque binary from one of four Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS TXT fallback via tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes it to /tmp or %TEMP% under names mimicking Microsoft diagnostics (dotnetdiag<hex>.exe /.cache<hex>), applies executable permissions via fs["chmod"+"Sync"], and spawns it detached via cp.spawn("/bin/sh", ["-c", filePath + " &"], {detached:true}) or cmd.exe. Dangerous APIs are split-string-obfuscated (require("child_"+"process"), os["host"+"name"]) to evade string scanners. lib/telemetry.js contains a redundant WorkerHost download-and-execute path with base64 payload decoding and the same spawn/chmod primitives. An opt-out env-var check (DISABLETELEMETRY / ANALYTICSOPTOUT / DONOTTRACK) and a /tmp/.analyticsstate stamp gate limit re-execution to roughly once per six hours, characteristic of dropper anti-analysis rather than legitimate telemetry. The declared "shared primitives" purpose is inconsistent with fetching and executing a native binary.