ded-aa-liza-ui-components@35.8.7

Analysis

On require, the package downloads a second-stage binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, path /pkg/package), with a DNS-TXT fallback channel via c[.]sdk[.]dl[.]wel1[.]ru. It fingerprints the host platform/arch, writes the fetched payload to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe on Windows), marks it executable, and launches it detached via cmd.exe /c start /b or /bin/sh -c. The package is a downloader that fetches and executes an arbitrary remote binary on the installer's machine.