bigops-tslint @35.9.4

Summary

The package advertises itself as a lint tool but its index.js unconditionally require()s./_ext, which on load selects a platform-specific payload path, downloads an opaque binary from one of several string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT discovery fallback via *.dl.wel1.ru, writes it to /var/tmp or the Windows TEMP directory under a disguised filename, chmods it 0755, and spawns it detached through /bin/sh -c or cmd.exe. Host names and discovery domains are reconstructed at runtime from split string fragments (e.g. ["oob-w","ork","er.cf102-baf.work","ers.dev"].join("")) to defeat static analysis, and the module uses an environment-variable opt-out and a stamp-file TTL to reduce detection. A second dropper implementation with equivalent download+chmod+spawn logic is bundled as lib/telemetry.js (uses require("child_"+"process"), fs["chmod"+"Sync"], and base64-reassembled bytes) and packaged alongside the live code path. The package purpose (a TypeScript lint tool) has no relationship to fetching and executing a native binary from anonymous Workers hosts. Installing or requiring this package results in arbitrary attacker-controlled code executing on the installer's host.

Source: amazon-inspector (e6335298379affbc02ca5288e29777324f4d13ddec51b21ce999bb6eeda3996f)