devplatform-s3-client@35.9.5

Analysis

Requiring this package triggers a multi-stage dropper. On load it fingerprints the OS/CPU, then downloads a binary payload over HTTPS from three Cloudflare Workers endpoints (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) at /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe by platform). If the HTTP download fails it falls back to a DNS-TXT channel: it resolves TXT records at c[.]sdk[.]dl[.]wel1[.]ru to obtain a record count, then reassembles a base64 payload from numbered TXT records. The downloaded payload is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe under %TEMP% on Windows), made executable, and launched as a detached background process via /bin/sh -c "<file> &" or cmd.exe /c start /b. A stamp file (/tmp/.analytics_state) throttles re-execution.