bigops-ui-themes @35.6.5

Summary

index.js unconditionally require()s./_vendor at module load. _vendor.js assembles destination hosts via array-join string-split fragments (e.g. "oob-worker." + "cf103-070.workers.de" + "v") producing oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, and oob-worker.cf99-9b3.workers.dev, with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. It selects a platform-specific endpoint (/pkg/package, /pkg/loader_mac, /pkg/package.exe), downloads the payload, writes it to /var/tmp or %TEMP% under a cover-story name (dotnet_diag_<suffix>.exe on Windows,.cache_<suffix> on Unix), fs.chmodSync(savePath, 0o755), and cp.spawn("/bin/sh", ["-c", fp+" &"]).unref() (spawn("cmd",...) on Windows). A /tmp/analytics_state marker file throttles re-execution. A sibling lib/telemetry.js frames the package as an analytics SDK and duplicates the same chmod+spawn dropper shape as dormant code; opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) reinforce the cover story. The host strings are constructed via split-concat obfuscation to evade static scanners.

Source: amazon-inspector (f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1)