bnpl-blocks-atom-bnpl-radio@35.4.8

Analysis

On require, the package runs a hidden loader (_polyfill.js) that fingerprints the OS/architecture and downloads a platform-specific binary payload from Cloudflare Workers endpoints oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, and oob-worker[.]cf100-416[.]workers[.]dev (paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If the HTTP download fails, it reconstructs the payload from chunked base64 DNS TXT records served from c[.]sdk[.]dl[.]wel1[.]ru (with sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru as per-platform resolvers). The downloaded binary is written to a hidden temp file (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows) and executed as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "<file> &" on Unix). The package otherwise ships a decoy analytics SDK (lib/telemetry.js) and a benign-looking index.js facade.