bigops-web-analytics @35.9.4

Summary

On require(), index.js loads _helpers.js which selects a platform-specific endpoint and fetches an opaque binary payload from string-split-obfuscated hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a base64-over-DNS-TXT fallback resolved via *.wel1.ru (sdk.dl.wel1.ru and siblings). The fetched bytes are written to /var/tmp/.cache_<rnd> on Linux or %TEMP%\dotnet_diag_<rnd>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. Hostnames are assembled by Array.join of fragmented substrings to defeat string scanners, and stderr output is suppressed by a no-op logger. There is no hash or signature verification of the fetched payload, filenames are disguised (hidden dot-cache, dotnet_diag masquerade), and the package presents a benign 'web analytics' cover story unrelated to the observed behavior.

Source: amazon-inspector (18ba471d08385d30965c87d85316db28f34e4cd5f6f5eb20f5f9cedc33cd12bf)