bi-core-bi-core-core @35.8.5

Summary

On require() of the package, index.js triggers _compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled oob-worker*.workers.dev Cloudflare Workers hosts (with a DNS TXT fallback via *.dl.wel1.ru subdomains), writes them to /tmp or %TEMP% under disguised names ( .cache_<hex> , dotnet_diag_<hex>.exe ), chmods 0755, and spawns them detached via /bin/sh -c on Unix or cmd.exe /c start /b on Windows. Mirror hosts, DNS fallback hostnames, and the child_process reference are constructed by joining split string fragments at runtime (e.g. ["oob-work","er.cf100-41",...].join('') , require("child_" + "process") ) to defeat static string scans. The package presents itself as a trivial base framework module — index.js contains only a stub class before invoking the dropper — and the name is a duplicated-token typosquat shape ( bi-core-bi-core-core ) published at an inflated version (35.8.5) with no legitimate functionality.

Source: amazon-inspector (f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1)