bigops-ui-kit-styles @35.5.7

Summary

On require() of bigops-ui-kit-styles, index.js loads _compat.js which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT fallback under *.dl.wel1.ru. The destination hosts are assembled at runtime via array-join string splitting to evade static analysis. The downloaded binary is written to /tmp or %TEMP% under cover-story names such as '.cache_<hex>' and 'dotnet_diag_<hex>.exe', chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe with.unref(). The exported BigopsUiKitStyles class in index.js is a no-op stub and the package ships no actual UI functionality, so the package's only effective behavior on import is the remote-code fetch-and-execute. Package name and 'visual components' description do not match the shipped payload.

Source: amazon-inspector (2db8a58fec98e1913d3aab98b7f40a0580a16aeea9b7d5af4cf560026b463ac1)