bigops-tinkoff-telephony-mock @35.5.1

Summary

On require() of the package, index.js loads _runtime.js which fetches a platform-specific binary from Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev and siblings) reconstructed at runtime from split string fragments, with a DNS TXT covert-channel fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under names disguised as.NET diagnostics files (dotnet_diag_*.exe,.cache_*), chmod'd 0755, and executed detached via /bin/sh -c '<path> &' or cmd /c start. No hash or signature verification is performed, and the destination hosts are unrelated to the package publisher. A second copy of the same dropper is bundled under lib/telemetry.js wrapped as a fake Sentry-like telemetry SDK. The package name mimics a Tinkoff telephony mock but the shipped code is a full-host remote-code-execution dropper against any machine that installs or imports it.

Source: amazon-inspector (29cb54c5f503b1cad2b4ae932f592d8870df743b1c1b6b029616343b65f6ae09)