dolyame-ui-badge@35.4.4

Analysis

Requiring this package (index.js) immediately loads _bootstrap.js, which downloads a platform-specific binary payload and executes it in the background. The payload is fetched over HTTPS from Cloudflare Workers endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) with paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe depending on OS/arch. If those fail, it reconstructs a base64 payload from DNS TXT records under sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru. The downloaded binary is written to /tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and launched detached via cmd.exe start /b or /bin/sh -c so it continues running after the parent exits. Execution is throttled by a timestamp marker file and can be suppressed by setting DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK.