ded-ps-ded-ps-core@35.9.1

Analysis

ded-ps-ded-ps-core is a multi-stage dropper. On require, its bundled _init.js downloads a binary payload over HTTPS from three Cloudflare Workers endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) at /pkg/package (platform-specific paths for arm64/darwin/windows). If the HTTP download fails it retrieves the payload via DNS TXT records from c[.]sdk[.]dl[.]wel1[.]ru. The payload is written to /var/tmp/.cache_<random> (or dotnet_diag_<random>.exe in TEMP on Windows) and executed as a detached background process via /bin/sh -c "<path> &" or cmd.exe /c start /b, with stdio ignored so it runs silently and outlives the parent. The package's index.js is a trivial stub whose only purpose is to trigger this download-and-execute on load.