bigops-chat-transfer@35.3.6

Analysis

bigops-chat-transfer@35.3.6 is a multi-platform binary dropper. On require(), _platform.js constructs C2 hostnames via string concatenation pointing to Cloudflare Workers infrastructure (oob-worker.cf1*-baf[.]workers[.]dev), downloads a platform-specific binary (Linux x64/arm64, macOS, Windows) via HTTPS, with a DNS TXT-record-based fallback delivery mechanism (domains: sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached, unref'd child process. A lock file at /tmp/.analytics_state prevents repeated downloads. The package also ships an 81KB decoy analytics SDK (lib/telemetry.js) to appear legitimate.