bigops-tcrm-auth @35.8.5

Summary

The package's main (index.js) requires./setup on load. setup.js selects a platform-specific payload path, downloads a native binary over HTTPS from Cloudflare Workers subdomains whose hostnames are reassembled at runtime via array-join fragments (e.g. ["oob","-worker.c","f101-adf.workers.d","ev"].join("")), with a DNS-TXT fallback that base64-reassembles the payload from *.dl.wel1.ru resolvers. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd on POSIX, and detached-spawned via /bin/sh -c or cmd /c start. Sensitive APIs are also fragmented (require("child_" + "process"), fs["chmod" + "Sync"]) to evade string matching. A sibling module lib/telemetry.js (3061 lines) presents itself as an "analytics SDK" but reproduces the same dropper primitives at larger scale (HTTPS endpoint rotation, DNS-based service discovery, base64 chunk assembly, chmod 0755, /bin/sh -c spawn). The package advertises itself as an authentication module, a purpose that has no legitimate need to fetch and execute a native binary from obfuscated hosts on import.

Source: amazon-inspector (4f4cc9ef61d16a5c70a1adc9c2ab3acb9e51d650967f02621410285d99efd4a1)