bigops-watchdog-worker @35.7.4

Summary

On require() of bigops-watchdog-worker, index.js loads _runtime.js which reconstructs remote hostnames from split-string fragments (e.g. joining ["oob-w","orker.cf102-baf.workers.d","ev"] and ['sdk.dl.wel1','.ru']), selects a URL keyed on process.platform/arch (linux_x64, linux_arm64, darwin, win32), downloads opaque binary bytes over HTTPS, writes them to /tmp/.cache_<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows (masquerading as a Microsoft diagnostic), chmods 0755, and spawns the binary detached via /bin/sh -c or cmd.exe. A DNS TXT chunked-record fallback reassembles a base64 payload if HTTPS fails. Anti-analysis features include a cache stamp at /tmp/.analytics_state that suppresses re-execution for ~23000 seconds and honors DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env vars to appear benign under inspection. Neither oob-worker.*.workers.dev nor *.dl.wel1.ru is a publisher-controlled or publisher-adjacent host.

Source: amazon-inspector (a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67)