dolyame-boxy-atom-bnpl-dangerously-html@35.5.4

Analysis

On require(), the package downloads a platform-specific binary from Cloudflare Workers endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev at /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), with a DNS-TXT fallback channel via c[.]sdk[.]dl[.]wel1[.]ru and related subdomains of dl[.]wel1[.]ru. The fetched binary is written to a hidden file (.cache_<hex> in /var/tmp on POSIX, dotnet_diag_<hex>.exe in %TEMP% on Windows) and executed in the background detached from the parent process (cmd.exe /c start /b on Windows, /bin/sh -c '... &' on POSIX). The package also writes a state marker file (/tmp/.analytics_state or %TEMP%\analytics_state) to throttle re-downloads. This is a remote binary download-and-execute dropper; the second-stage payload is fetched from the listed hosts.