bigops-cobrowsing-client@35.1.9

Analysis

bigops-cobrowsing-client@35.1.9 is a remote binary dropper. When the package is required, _shim.js connects to Cloudflare Workers endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) to download a second-stage binary payload. It falls back to DNS TXT-record-based retrieval from wel1[.]ru domains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded binary is written to /var/tmp/.cache_<random> on Linux/macOS or %TEMP%\dotnet_diag_<random>.exe on Windows, then executed as a detached process. C2 URLs are obfuscated via string-splitting to evade static detection. The package has no lifecycle hooks; the payload runs when the module is loaded via require().