bigops-chat-messages @19.9.8

Summary

On require() of bigops-chat-messages, _helpers.js selects a platform-specific remote path, fetches an opaque binary over HTTPS from *.workers.dev hosts whose names are reconstructed at runtime from split string arrays joined with.join(''), with a DNS-TXT base64 fallback resolved against tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site and win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmodded 0755, and spawned detached via spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() or the Windows cmd equivalent so the child process survives the parent. The package is advertised as a chat-messages interface and has no legitimate need to fetch and execute a platform-specific binary from anonymized hosts at load time. The string-split obfuscation of the destination hostnames, the diagnostics-masquerading filenames, and the detached spawn are consistent with a hostile import-time dropper.

Source: amazon-inspector (1c9f7e6d6c045bdc74c458ac7d4f99af74364a6d6fc5750815e42447c3f7e8fa)