bigops-chat-tmsg@35.8.5

Analysis

When required, the package silently downloads and executes a platform-specific binary payload. It fingerprints the host (OS, architecture) to select the correct binary, then attempts HTTPS downloads from three Cloudflare Workers C2 endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) with random rotation. If HTTPS fails, it falls back to DNS TXT-based chunked payload retrieval from domains including sd[.]k[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows), made executable, and spawned as a detached background process with stdio discarded. The package has no repository, no meaningful documentation, and its name impersonates an internal module pattern.