bigops-chat-files-hub-client@35.4.6

Analysis

On require(), the package downloads a platform-specific binary from Cloudflare Workers subdomains (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET to paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on the host OS/arch. If HTTPS fails, it falls back to DNS TXT-based data retrieval from domains under wel1[.]ru (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded binary is written to /var/tmp/.cache_<random> (Linux) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. A marker file at /tmp/.analytics_state (or %TEMP%\analytics_state) limits re-download frequency. The package has no repository and no documented purpose beyond a generic stub class.