bigops-header-tabs@35.8.2

Analysis

bigops-header-tabs@35.8.2 is a trojanized package that drops and executes a platform-specific binary payload. On require(), it loads _adapter.js which fingerprints the host OS and architecture, then downloads a binary from Cloudflare Workers C2 infrastructure (oob-worker[.]cf10-2-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) with fallback to DNS TXT-based payload retrieval from wel1[.]ru domains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached process. A lock file at /tmp/.analytics_state prevents re-download within ~6 hours. The package has no repository, no README content beyond boilerplate, and no lifecycle hooks — the payload runs silently at import time.