bigops-telephony-client @35.7.6

Summary

On require() of bigops-telephony-client, index.js loads./_runtime.js, which unconditionally downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose domains are reconstructed by joining split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev). The downloaded bytes are written to a disguised location under /tmp or %TEMP% (e.g..cache_<rand>, dotnet_diag_<rand>.exe mimicking a.NET diagnostic tool), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. A fallback code-delivery channel resolves DNS TXT records at sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, using 'c.<domain>' to obtain a chunk count and '0.<domain>'..'N.<domain>' to reassemble a base64-encoded payload. lib/telemetry.js ships a parallel drop-and-execute implementation (WorkerHost/NativeProfiler under an 'Analytics SDK' cover story) with the same primitives, currently unreferenced by the main entry. The combination of split-string domain construction, DNS-TXT covert channel, disguised drop paths, detached spawn, and duplicate loader is a supply-chain dropper delivering arbitrary attacker-controlled code to every consumer.

Source: amazon-inspector (98fd12faa59a5e65d0383cfb3be55ccd49beca5c74cb350b62f5717be83bcd65)