bigops-awesome-viewer@35.1.4

Analysis

At require time, the package downloads and executes a binary payload. It detects the OS/architecture, then fetches a binary from Cloudflare Workers endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS. If those fail, it falls back to DNS TXT-record-based chunked download from domains including sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<random-hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and spawned as a detached process. The package has no repository and no documented purpose beyond a generic description.