bigops-auth-provider-interceptor@35.8.3

Analysis

bigops-auth-provider-interceptor is a trojanized dependency-confusion package that drops and executes a remote binary on the installer's machine. When required, _init.js downloads a platform-specific binary (linux_x64, linux_arm64, darwin, win32) from Cloudflare Workers C2 hosts (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) with fallback DNS-based download from Russian domains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached process. The package uses a filesystem stamp at /tmp/.analytics_state to avoid re-infection within 22774 seconds. The index.js exports a benign TokenManager class as a decoy, while _init.js performs the download and execution. The package has no lifecycle hooks — the payload runs on import via require().