devplatform-api-v1-endpoint@35.9.8

Analysis

On require, this package (a stub "service client SDK") downloads and executes a remote binary. It fingerprints the platform/arch, then fetches a second-stage payload over HTTPS from one of three Cloudflare Workers hosts (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If the HTTP fetch fails it falls back to a DNS-TXT delivery channel against the domains sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, and net[.]dl[.]wel1[.]ru (a TXT record on c.<domain> gives the chunk count; numbered TXT records base64-decode to the payload). The downloaded binary is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe in the temp dir on Windows), made executable, and launched detached via cmd.exe /c start /b (Windows) or /bin/sh -c (Unix).