bigops-info-notices@35.9.8

Analysis

On require(), the package silently downloads and executes a platform-specific binary payload. It fingerprints the operating system and architecture, then attempts to download a binary from a rotating list of Cloudflare Workers endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) via HTTPS, with a DNS TXT-record-based fallback through wel1[.]ru subdomains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded binary is written to /var/tmp/.cache_<random-hex> on Linux/macOS or %TEMP%\dotnet_diag_<random-hex>.exe on Windows and executed as a detached process. The package has no repository and its description is fabricated.