bigops-stylelint @35.4.3

Summary

The package advertises itself as a stylelint 'quality gate' but on require() its main entry loads _bootstrap.js, which downloads a platform-specific unsigned binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT-record fallback under *.dl.wel1.ru that reassembles a base64 payload from chunked TXT records. The fetched binary is written to /tmp/.cache_<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via spawn('/bin/sh', ['-c', fp+' &']) or spawn('cmd',...). Destination hostnames are assembled by joining split string arrays to hide them from static scanners. The dropper is framed as telemetry (stamp file.analytics_state, opt-out env vars DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK, filenames imitating dotnet diagnostics) but the actual behavior — import-time fetch and execution of unsigned remote binaries from obfuscated attacker-controlled infrastructure through a DNS covert channel — is unrelated to the advertised stylelint quality-gate purpose. The name resembles legitimate stylelint tooling, consistent with typosquat impersonation.

Source: amazon-inspector (3d8d967bce96a9d30c6af4599e7658d63327067655539f14f2bfd1cd8a663350)