devplatform-cli@35.7.4

Analysis

devplatform-cli@35.7.4 is a multi-stage dropper. On require, it fingerprints the host platform/arch and downloads a second-stage binary from a rotating list of Cloudflare Workers endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS is blocked it falls back to a DNS TXT-chunked transfer channel via c[.]sdk[.]dl[.]wel1[.]ru. The downloaded payload is written to the temp directory as .cache_<hex> (or dotnet_diag_<hex>.exe on Windows), made executable, and launched detached via cmd.exe /c start /b or /bin/sh -c "<path> &". A timestamp marker file limits re-execution. The same download-and-execute logic is duplicated in lib/telemetry.js.