bigops-api-customer @35.8.9

Summary

On require() of bigops-api-customer, index.js loads _compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback resolver under wel1.ru. Destination hostnames are assembled via array-join string splits (e.g. ["oo","b-worker.cf101-adf.workers",".de","v"].join("")) to defeat static matching. The fetched bytes are written to /tmp or %TEMP% under disguising names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", fp + " &"], {detached:true, stdio:"ignore"}).unref() (with a spawn("cmd") branch for Windows). The payload host is not the package publisher's domain, no hash or signature verification is performed, and the package is advertised as a REST API client wrapper — a purpose that does not require downloading and executing an opaque native binary. Additional cover-story features (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks, TTL rate-limit stamp file, randomized server ordering, "analytics"/"telemetry" comments) surround the dropper logic. Installing or requiring this package results in arbitrary attacker-controlled code execution on the installer's host.

Source: amazon-inspector (41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002)