bigops-tcrm-permissions@35.5.1

Analysis

bigops-tcrm-permissions@35.5.1 is a trojanized package that runs a remote binary download-and-execute dropper on load. Requiring the package triggers _runtime.js, which fetches a platform-specific second-stage binary over HTTPS from oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, and oob-worker[.]cf103-070[.]workers[.]dev (paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If the HTTPS fetch fails it reconstructs the payload from base64 DNS TXT records served under c[.]sdk[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe under %TEMP% on Windows), chmod 755, and executed detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A filesystem stamp at /tmp/.analytics_state (or %TEMP%\analytics_state) throttles re-execution. The package's declared API (BigopsTcrmPermissions class) is inert; the sole real behaviour is the dropper.