devplatform-spa-plugin-module@35.7.9

Analysis

The package runs a multi-stage dropper on require. It fetches a platform-specific binary payload over HTTPS from a set of Cloudflare Workers hosts (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, and /pkg/package.exe. If the HTTPS fetch fails it falls back to retrieving the payload via DNS TXT records from c[.]sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru (base64-encoded chunks reassembled). The downloaded payload is written to a hidden file (.cache_<hex> in /var/tmp on Unix, dotnet_diag_<hex>.exe in the temp dir on Windows), made executable, and launched detached via cmd.exe /c start /b (Windows) or /bin/sh -c 'file &' (Unix) with stdio ignored, so it runs in the background and outlives the parent process.