bigops-umf-statist @35.3.1

Summary

On require('bigops-umf-statist'), index.js loads _runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback channel that reassembles a base64 payload from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a masquerading name (dotnet_diag_<hex>.exe or.cache_<hex>), chmod 0755, and spawned detached via cmd.exe or /bin/sh. Destination hostnames are reconstructed at runtime by array-join to evade static inspection, and no signature or hash verification is performed on the downloaded payload.

Source: amazon-inspector (da63079fe1017b1a4ade225e41fbb7479ab0a247b235d62b252470ff9f07e1d7)