MAL-2026-15913

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651)

The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it in memory by piping the bytes into a detached node - child process (spawn(process.execPath, ["-"], {detached:true, stdio:["pipe","ignore","ignore"], windowsHide:true})). No signature or hash verification is performed and the README explicitly states client contents are not verified. Supporting evasion characteristics are present: state is kept in a random 8-byte hex subdirectory under the app-data root with a pointer.json indirection, the child is spawned detached with windowsHide:true and stdio ignored, a prior worker PID is SIGTERM'd before each execution, and the package documents that directory and internal filenames are intentionally non-descriptive. The package supplies no legitimate library functionality beyond executing remote code; whoever controls the configured origin obtains full code execution on the host during any version-check poll.