bigops-storio-schematics @35.3.6

Summary

index.js unconditionally requires _runtime.js, whose top-level start() function selects a platform-specific asset path, fetches an opaque binary from string-array-obfuscated hostnames reconstructed at runtime (oob-worker.cf1-03-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a hidden file under /tmp or %TEMP% with a random suffix (e.g..cache_<hex> or dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. A fallback covert channel resolves c.<domain> TXT records for a chunk count, then fetches <i>.<domain> TXT records from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru and base64-decodes the concatenation into the executable payload, bypassing HTTP egress filtering. No hash or signature verification is performed and the destination is not the publisher. A sibling file lib/telemetry.js under an 'analytics-sdk' cover story ships the same download→base64-decode→chmod 0755→sh -c file & chain as a staged alternate payload. Requiring or installing this package causes attacker-controlled native code to run on the installer's machine.

Source: amazon-inspector (85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b)