devplatform-jscodeshift-utils@35.3.8

Summary

The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try { require('./_bootstrap'); } catch (_) {} on module load, hiding the malicious side effect behind a swallowed exception. _bootstrap.js selects a platform-specific payload path, downloads bytes from one of three hardcoded Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) — with a DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru — writes the payload to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd /c start. Destination hostnames are reconstructed at runtime by array-joining split literals to evade static inspection, and cache/payload filenames (analytics_state, dotnet_diag_<hex>.exe) are chosen to blend in with legitimate telemetry artifacts. An 80KB lib/telemetry.js is shipped but never referenced from index.js, consistent with cover-story padding. Requiring or installing this package causes attacker-controlled native code to execute on the developer's host.

Source: amazon-inspector (3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9)