bigops-data-storage@35.7.1

Analysis

The package loads a bundled module (_compat.js) on require that downloads a platform-specific binary from Cloudflare Workers C2 infrastructure and executes it as a detached process. The C2 hosts are oob-worker[.]cf101-a[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, and oob-worker[.]cf100-416[.]workers[.]dev. A DNS-based fallback mechanism uses domains under wel1[.]ru. The downloaded binary is saved to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned detached. The package has no repository, no README content beyond boilerplate, and no documented purpose matching its name.