dolyame-boxy-stories@35.9.7

Analysis

On require, the package downloads a platform-specific second-stage binary over HTTPS from Cloudflare Workers endpoints (oob-worker[.]cf103-070[.]workers[.]de, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) with a DNS-TXT fallback channel via wel1[.]ru resolver domains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru). The downloaded payload is written to a temp file (/var/tmp/.cache_<hex> on Unix, %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and launched as a detached background process via cmd.exe /c start /b or /bin/sh -c '... &'. A stamp file in /tmp or %TEMP% throttles re-execution. The package ships a large decoy analytics module to pad its size.