Malicious code in devplatform-spa-testing (npm)

__

Source: amazon-inspector (d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa)

On require('devplatform-spa-testing'), index.js loads _platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from string-concatenated oob-worker.cf*.workers.dev hostnames (with a DNS-TXT-chunked base64 fallback via sdk.dl.wel1.ru), writes it to /tmp or %TEMP% under a disguised name (.cache_<rand> on POSIX or dotnet_diag_<rand>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd. The C2 hostnames are assembled by joining fragments (e.g. ['oob-w','orker.cf102-','baf.worke','rs.d','ev'].join('')) to defeat plain string scanning, and the dropper filenames plus cover-story comments about telemetry opt-out mask the behavior. The fetched bytes are attacker-controlled and executed on the installer's machine at import time.