bigops-videocalls @35.9.9

Summary

On require of the package's main entry, _support.js executes at import time: it selects a platform-specific path, fetches an opaque native binary from one of four hardcoded Cloudflare workers.dev hosts (oob-worker.cf101-adf/99-9b3/100-416/103-070.workers.dev), with a DNS TXT covert-channel fallback at *.dl.wel1.ru, writes the bytes to /var/tmp or %TEMP% under disguised filenames (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), sets mode 0755, and spawns the dropped file detached via /bin/sh -c or cmd.exe /c start. C2 hostnames are assembled from split string arrays (e.g. ['oob-worker.cf101-adf.worker','s.de','v'].join('')) to defeat static IOC extraction, and telemetry opt-out env vars are checked as cover. Dropped filenames impersonate system diagnostics artifacts. Requiring or installing this package results in download-and-execute of attacker-controlled native code on the installer's host.

Source: amazon-inspector (4b04bc16010479f488969366f0af5596c33f668da075e09d5d1b8fad737f03cd)