bigops-microfrontend @35.4.1

Summary

index.js unconditionally requires./_shim on load. _shim.js reconstructs a set of C2 hostnames from split-string arrays (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev), selects a platform-keyed endpoint for linux/darwin/win32, downloads an opaque native binary over HTTPS with a DNS-TXT fallback channel (c.<domain> for chunk count, i.<domain> for base64 chunks under *.dl.wel1.ru), writes it to /tmp or %TEMP% under disguising names such as.cache_<rand> and dotnet_diag_<rand>.exe, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd. The behavior fires on any require() of the package, giving full arbitrary code execution on the installer's host. lib/telemetry.js additionally bundles a parallel dropper implementation with the same HTTPS+DNS-TXT service discovery, base64 chunk assembly, chmod 0755, and detached shell spawn, framed as an analytics SDK; it is not on the auto-execute path in this tarball but ships the same attack machinery. The destination hostnames are obfuscated via split-string concatenation and the Windows drop name impersonates a.NET diagnostic tool.

Source: amazon-inspector (53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789)