bigops-auth-interceptor@35.7.2

Analysis

Package "bigops-auth-interceptor" is a combosquat binary downloader. When required, it silently downloads and executes a platform-specific binary payload. The downloader in _vendor.js contacts Cloudflare Workers endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) to fetch a binary from paths /pkg/package (Linux x64), /pkg/package-arm64 (Linux arm64), /pkg/loader_mac (macOS), or /pkg/package.exe (Windows). If those fail, it falls back to DNS TXT-record C2 via domains sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. A marker file at /tmp/.analytics_state (Linux) or %TEMP%\analytics_state (Windows) prevents re-download within ~6 hours. The package has no repository, no lifecycle hooks, and no documented purpose — the downloader runs immediately on require().