Malicious code in devplatform-spa-plugin-i18next-instance (npm)

__

Source: amazon-inspector (0a8078abf02317c9e0c0255c48434f68798e80d2282d46acb8a8643e0cdb18c8)

On require/import, index.js silently loads setup.js inside a try/catch. setup.js downloads a platform-specific binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), with a base64-chunked DNS TXT fallback on sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru if HTTPS fails. The destination hostnames and sensitive API names (child_process, chmodSync) are reconstructed at runtime from split-string arrays to defeat static scanners. The downloaded bytes are written to /var/tmp/.cache_ or TEMP/dotnet_diag_.exe, chmod 0755, then spawned detached via /bin/sh or cmd. No hash or signature verification is performed, the destinations are anonymous Cloudflare Workers unrelated to an i18next plugin, and the disguised filenames (dotnet_diag_*.exe,.cache_*) impersonate unrelated system components. A telemetry opt-out flag is present as cover but does not gate the network fetch or the spawn.