bnpl-blocks-atom-bnpl-navigation-arrow@35.2.6

Analysis

On require, the package downloads and executes a remote binary. It writes a cache marker to /tmp/.analytics_state (or %TEMP%\analytics_state on Windows), then fetches a platform-specific payload over HTTPS from oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, and oob-worker[.]cf103-070[.]workers[.]dev at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, and /pkg/package.exe. If the download fails it falls back to a DNS-over-TXT channel via c[.]sdk[.]dl[.]wel1[.]ru, reassembling base64 chunks. The payload is written to a hidden file (.cache_<hex> in /var/tmp, or dotnet_diag_<hex>.exe in %TEMP% on Windows), made executable, and launched as a detached background process (/bin/sh -c "<file> &" or cmd.exe /c start /b).