bigops-telephony @35.8.4

Summary

On require('bigops-telephony'), index.js loads _adapter.js which selects a platform-specific asset path, fetches an opaque binary from one of three runtime-assembled workers.dev hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT base64-reassembly fallback under *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<rand>.exe or.cache_<rand>, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Host strings are reassembled from split arrays at runtime and execution is gated by environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) plus a marker file at /tmp/.analytics_state to mimic legitimate telemetry. A second, currently-unreferenced dropper module at lib/telemetry.js is shipped alongside and performs the same base64-decode -> chmod 755 -> spawn /bin/sh chain under an 'analytics SDK' cover story.

Source: amazon-inspector (da1b7311c033191d85d0d19c679ac9d453f7517897b57618d0d8977d654daf94)