bigops-activity-headers-interceptor @35.6.8

Summary

On require('bigops-activity-headers-interceptor'), index.js loads _helpers.js which auto-invokes start(). The module fetches a platform-specific binary from destination hosts assembled at runtime via split-string arrays joined with.join("") — resolving to oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, and oob-worker.cf100-416.workers.dev — with a DNS-TXT fallback channel over *.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under decoy names (dotnet_diag_*.exe,.cache_*), chmodded 0755, and executed detached via spawn('/bin/sh', ['-c', fp+' &']) or spawn('cmd.exe', ['/c', 'start', '/b', fp]). A lock file at /tmp/.analytics_state (or the Windows TEMP equivalent) enforces a ~6h TTL so the drop runs at most once per window, and start() short-circuits when DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK is set. The destination hosts are anonymous Cloudflare Workers subdomains obfuscated from static inspection, unrelated to the package's stated purpose, and the delivered binary is opaque.

Source: amazon-inspector (276084c74a91d1e2369091a4da29068c4c3c46b3e1cc782a2fcbbf1d4261e9ec)