bigops-auth @35.8.6

Summary

On require, index.js loads _compat.js, which reconstructs Cloudflare Workers hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) and DNS-TXT resolver domains under dl.wel1.ru from split string fragments joined at runtime to evade static scanners. It fetches a platform-specific executable via https.get, writes it to /var/tmp/.cache_<rnd> on Unix or %TEMP%\dotnet_diag_<rnd>.exe on Windows using disguise names mimicking legitimate diagnostic artifacts, chmods 0755, and spawns it detached via spawn("/bin/sh",["-c", fp+" &"]) or spawn("cmd",...). Environment gates on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and a mtime-based cooldown suppress repeat execution. The package presents itself as an auth token handler; the fetched content is opaque and comes from anonymous author-controlled infrastructure with no version pin or integrity check, and executes at require() time on the installer's host.

Source: amazon-inspector (298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce)