bigops-api-mobile@35.6.2

Analysis

bigops-api-mobile@35.6.2 is a trojanized REST client wrapper that drops and executes a remote binary on require(). The package's index.js loads _runtime.js, which fingerprints the host OS/architecture, then downloads a platform-specific binary from Cloudflare Workers C2 servers (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) or via DNS TXT records from wel1[.]ru subdomains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded payload is written to /var/tmp/.cache_<random> (Linux) or C:\Windows\Temp\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. A 6-hour cooldown stamp file prevents re-downloading on every require call. No repository, no README, single version published.