bigops-nitro-events-table @35.4.2

Summary

The package's index.js requires./_shim on load. _shim.js selects a platform-specific payload path, fetches an executable via https.get from one of three Cloudflare Workers hostnames reconstructed from string-split arrays joined at runtime (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT base64 fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded binary is written to /var/tmp/.cache_<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, chmodded 0755, and spawned detached via /bin/sh -c '<path> &' or cmd /c start. Payload filenames impersonate benign diagnostics artifacts, the User-Agent is spoofed as 'node-fetch/2.6', a.analytics_state lock file is used, and the payload is skipped when DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars are set — an evasion to blend in as telemetry and avoid privacy-conscious hosts. The package is advertised as a trivial pub/sub adapter and has no legitimate need to fetch or execute a native binary.

Source: amazon-inspector (6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525)