bigops-create-manifest@35.2.4

Analysis

The package bigops-create-manifest@35.2.4 is a trojanized binary downloader. At require-time, it silently fetches a remote binary from Cloudflare Workers endpoints (oob-worker[.]cf102-baf[.]workers[.]de, oob-worker[.]cf100-416[.]workers[.]de, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) with a fallback to DNS TXT-based payload retrieval from domains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded binary is written to /tmp/.cache_<random> (Linux) or C:\Windows\Temp\dotnet_diag_<random>.exe (Windows), made executable, and spawned as a detached process. The package has no repository, no lifecycle scripts, and its only purpose is to download and execute a remote payload.