tui-react-tooltip@20.5.4

Summary

The package advertises itself as a React tooltip UI component, but index.js (declared main) unconditionally requires _loader.js, which on module load downloads a platform-specific binary from hardcoded hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT fallback to tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes it to /tmp or %TEMP% under disguised names (.cache_<rnd>, dotnet_diag_<rnd>.exe), chmods it 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd.exe start /b. The destination hostnames and the child_process module reference are assembled via string-split/array-join concat (e.g. ["oob","-worker.cf103-070.","workers.de","v"].join("")) to evade static string scanners. A TTL marker in the temp directory suppresses re-execution. Sibling file lib/telemetry.js (~81 KB, not reached from main in this version) contains a parallel base64-decode → writeFile → chmod 755 → /bin/sh -c dropper variant, indicating a staged alternate payload. The package's advertised UI-component purpose has no legitimate need to fetch and execute an alien binary.

Source: amazon-inspector (5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df)