bigops-auth-cache@35.3.9

Analysis

On require(), bigops-auth-cache loads a bundled downloader module (_compat.js) that contacts Cloudflare Workers C2 endpoints (oob-worker[.]cf*.workers[.]dev) to fetch a platform-specific binary payload. The payload is written to /var/tmp/.cache_<random> (or Windows Temp\dotnet_diag_<random>.exe), made executable, and spawned as a detached process. A DNS TXT-record based fallback mechanism using domains on wel1[.]ru provides an alternative payload delivery channel. The package uses a flag file at /tmp/.analytics_state to limit re-infection frequency. The main export (MemoryCache) is a decoy; the real behaviour is a multi-stage binary downloader and execution implant.