bigops-figma-to-html@35.5.5

Analysis

bigops-figma-to-html@35.5.5 is a trojanized package that downloads and executes a platform-specific binary payload on install. The package's index.js immediately requires _bootstrap.js, which fingerprints the OS and architecture (linux/x64, darwin/arm64, win32/x64, etc.) and then fetches a binary from one of four Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET /pkg/package (or platform-specific paths like /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If HTTPS fails, it falls back to DNS-based chunked download via TXT records on c[.]sdk[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows) and spawned as a detached background process. The package also ships a large decoy file (lib/telemetry.js, 81KB) to pad the tarball and disguise the implant.