bigops-api @35.8.8

Summary

On require('bigops-api'), index.js loads _compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames (fragments joined at execution to form oob-worker.cf102-baf.workers.dev and sdk.dl.wel1.ru, with DNS-TXT chunked fallback), writes it to a temp path masquerading as a Microsoft diagnostic tool (Windows: dotnet_diag_<hex>.exe; Unix:.cache_<hex> under /var/tmp), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. No signature or hash verification is performed. A secondary bundled module lib/telemetry.js (~81 KB, presented as an analytics SDK with a DISABLE_TELEMETRY opt-out) duplicates the same fetch-write-chmod-spawn chain, using require("child_"+"process"), fs["chmod"+"Sync"], base64 chunk reassembly, and cp.spawn("/bin/sh", ["-c", filePath + " &"]). Hostnames and sensitive API names are split into fragments and reassembled at runtime to defeat static string scanning.

Source: amazon-inspector (49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6)