dolyame-boxy-atom-desktop-bnpl-highlighted-text@35.5.6

Analysis

On load, the package executes a hidden loader (required from the main entry point) that downloads a platform-specific binary over HTTPS from Cloudflare Workers endpoints oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, and oob-worker[.]cf102-baf[.]workers[.]dev at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on OS/arch. If the HTTPS download fails it falls back to retrieving the payload in base64 chunks via DNS TXT queries against the wel1[.]ru domain (c[.]sdk[.]dl[.]wel1[.]ru and numbered subdomains). The downloaded payload is written to a hidden temp file (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), made executable, and launched as a detached background process via cmd.exe /c start /b or /bin/sh -c "file &". The package otherwise ships a decoy analytics-SDK module and a stub class; the loader runs automatically when the module is required.