bigops-alerts-widget @35.8.3

Summary

On require() of bigops-alerts-widget, _vendor.js selects a payload path based on process.platform and process.arch, downloads an opaque binary from one of several anonymous Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp or %TEMP% under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via spawn('/bin/sh') or spawn('cmd'). Destination hostnames are assembled from split character arrays via Array.join to avoid appearing as plain strings. If the primary fetch fails, a fallback path issues multiple DNS TXT queries against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, concatenates the returned records, and base64-decodes them into an executable buffer that is then run the same way. Import-time execution of an attacker-controlled binary from anonymous infrastructure, combined with string-obfuscation of the destinations and a DNS-TXT covert channel, gives whoever published this package remote code execution on the installer's host.

Source: amazon-inspector (d1ece35b981e6725d807e3bfe7da2bc7e2129bb49fa6f656866ace6f67079284)