bigops-telephony-ui @35.7.3

Summary

On require of the package, _shim.js downloads a platform-specific executable over HTTPS from string-concatenated hostnames (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adfs.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked fallback to sdk.dl.wel1.ru and sibling *.dl.wel1.ru subdomains. The retrieved bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via spawn("/bin/sh", ["-c",...]) or spawn("cmd",...). Host strings and the require("child_process") / fs.chmodSync API names are reassembled at runtime via array.join("") to defeat static inspection. The advertised purpose is a React UI component library; nothing about the fetched binary, the decoy filenames, or the anonymous Cloudflare Workers / DNS-fallback delivery matches that stated purpose.

Source: amazon-inspector (93b10fc5eff860f82de5bc03b910dbe2b96b06d54c22741cbb593b007dd9ee38)