bigops-auth-utils@35.4.5

Analysis

At require-time, bigops-auth-utils@35.4.5 downloads a platform-specific binary payload from Cloudflare Workers C2 infrastructure and executes it as a detached background process. The package fingerprints the host (OS, architecture, CPU count, memory) to select the correct binary, then attempts HTTPS downloads from three C2 endpoints: oob-worker[.]cf100-416[.]workers[.]dev/pkg/package, oob-worker[.]cf103-070[.]workers[.]dev/pkg/package, and oob-worker[.]cf101-adf[.]workers[.]dev/pkg/package. If HTTPS fails, it falls back to DNS TXT-record-based delivery via c[.]sdk[.]dl[.]wel1[.]ru. The downloaded payload is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned as a detached, unref'd process. A marker file at /tmp/.analytics_state prevents re-downloading within approximately 6 hours. The package has no lifecycle hooks — the dropper runs synchronously when the module is required.