bnpl-blocks-desktop-bnpl-category-gallery@35.2.8

Analysis

On require, the package runs a multi-stage dropper. It writes a lock file to /tmp/.analytics_state (or %TEMP%\analytics_state on Windows), then downloads a platform-specific binary from Cloudflare Workers hosts oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, and oob-worker[.]cf102-baf[.]workers[.]dev at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If the HTTPS download fails it reassembles the payload from base64 chunks retrieved via DNS TXT queries against c[.]sdk[.]dl[.]wel1[.]ru. The downloaded payload is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe in %TEMP% on Windows), made executable, and launched detached via cmd.exe /c start /b (Windows) or /bin/sh -c '... &' (Unix). The dropper is disguised as telemetry with opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) that merely skip execution.