bigops-cobrowsing@35.4.9

Analysis

On require(), the package loads _compat.js which downloads and executes a platform-specific binary. It resolves the OS/arch (linux_x64, linux_arm64, darwin, win32), then fetches a binary from Cloudflare Workers origins (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If those fail, it falls back to a DNS TXT-based chunked download from domains including c[.]sdk[.]dl[.]wel1[.]ru, sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<random> (Linux) or %TEMP%\dotnet_diag_<random>.exe (Windows), made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "fp &" on Linux). A marker file at /tmp/.analytics_state (or %TEMP%\analytics_state) prevents re-downloading for ~5.8 hours.