bigops-timeline-ui @35.5.8

Summary

On require() of bigops-timeline-ui, index.js loads./_adapter.js which fetches a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback channel under *.dl.wel1.ru that reassembles a base64-encoded binary from numbered subdomain lookups. The fetched bytes are written to a hidden temp file using cover-story names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755 is applied, and the file is spawned detached via /bin/sh -c or cmd.exe /c start. There is no version pinning, no hash or signature verification, and the destinations are unrelated to any documented publisher for a timeline UI package. Runtime hostname construction and the DNS TXT transport are anti-analysis measures rather than legitimate delivery mechanisms.

Source: amazon-inspector (4a6a5b474ef344ddb8aa478f73099e3644817aa8a87199eaa3c46f03d27baa13)