bigops-tasks-client @35.1.2

Summary

On require() of the package, index.js unconditionally loads _compat.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT chunked-base64 fallback under *.dl.wel1.ru (sdk/ext/pkg/net subdomains). The fetched bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and detach-spawned via spawn("/bin/sh", ["-c", path+" &"], {detached:true}).unref() (spawn("cmd",...) on Windows). Hostnames and asset paths are runtime-assembled from split fragments (e.g. ["oob","-worker.cf100","-416.wor","ker","s.d","ev"].join("")) to evade static string scanning; drop filenames impersonate benign tooling (dotnet_diag_,.cache_, loader_mac, package.exe, package-arm64). The advertised "tasks client" purpose has no relation to fetching and executing a native binary from Cloudflare Workers infrastructure at import time.

Source: amazon-inspector (08e2dc270f95427849a0d3560958c363536ef336456a15337845969b682e9e68)