bigops-tasks @35.1.4

Summary

On require('bigops-tasks'), index.js side-effect loads _vendor.js which downloads a platform-specific native binary from string-fragment-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The hostnames are assembled from split string fragments joined at runtime. The fetched bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows (a filename mimicking a Microsoft diagnostic tool), chmod 0755'd, and spawned detached via /bin/sh or cmd. No hash or signature verification is performed despite a misleading 'SHA-256 integrity check' comment. Comments frame the behavior as 'analytics'/'telemetry' cover-story.

Source: amazon-inspector (80be948322937758b568e63d82d769aa07a443a3b849cf19fd440ed5bf4505ec)