bigops-voximplant@20.8.5

Analysis

bigops-voximplant is a trojan downloader disguised as a voximplant interface library. On require(), it silently fingerprints the host (platform, arch, hostname, CPU count, memory) and downloads a platform-specific binary payload from Cloudflare Workers C2 hosts (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET requests to /pkg/package (Linux x64), /pkg/package-arm64 (Linux arm64), /pkg/loader_mac (macOS), or /pkg/package.exe (Windows). If HTTPS fails, it falls back to DNS TXT-based retrieval from tin[.]dl[.]well1[.]site and related subdomains. The downloaded binary is saved to /var/tmp/.cache_* (Linux/macOS) or %TEMP%\dotnet_diag_*.exe (Windows) and executed as a detached background process. A cooldown mechanism using /tmp/.analytics_state prevents re-download within ~5.5 hours. The package has no repository, no README, and no actual voximplant functionality.