bigops-eslint-config@35.1.9

Analysis

Package bigops-eslint-config@35.1.9 is a trojanized combosquat package that downloads and executes a remote binary payload on require(). The file _vendor.js contains a multi-stage dropper: it contacts Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) to download a platform-specific binary, with a DNS TXT-record fallback retrieval mechanism via domains sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or C:\Windows\Temp\dotnet_diag_<hex>.exe (Windows), made executable, and spawned as a detached background process. A stamp file at /tmp/.analytics_state prevents re-downloading within ~5.8 hours. The package ships no ESLint configuration files despite its name — the eslint-config label is a lure.