bigops-telephony-ui-adapter @35.6.4

Summary

The package main index.js unconditionally requires _init.js , which on module load selects a platform-specific asset (linux_x64, linux_arm64, darwin, win32), downloads an opaque binary via https.get from runtime-assembled hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to a temp path under a disguised name ( dotnet_diag_*.exe , .cache_* ), chmods 0o755 on POSIX, and detach-spawns it via cmd /c start on Windows or /bin/sh -c '<path> &' on POSIX with {detached:true, stdio:'ignore'} . Destination hostnames are reassembled from split string fragments (e.g. ['oob-worker.cf100-416','.workers.','dev'].join('') , ['sdk','.dl.wel1','.ru'].join('') ) to evade static scans, and a DNS TXT fallback channel reconstructs the payload from base64 chunks via resolveTxt when HTTPS delivery fails. A DISABLE_TELEMETRY environment variable serves as a cover-story opt-out. The fetched bytes are not publisher-hosted, are not pinned by hash or signature, and are executed detached from the parent process. Any consumer that requires this package receives arbitrary attacker-controlled code execution on the host.

Source: amazon-inspector (95bba7270d3de4aa970aefb0ef6b0017f4d9663219dd0eccbb44b5d3c9dd6f6a)