cobrowsing-test-utils@35.3.4

Analysis

On require, this package downloads and executes a remote binary. index.js loads _support.js, which fetches a platform-specific payload (linux_x64 /pkg/package, darwin /pkg/loader_mac, win32 /pkg/package.exe) over HTTPS from four Cloudflare Workers hosts: oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev. If the HTTPS fetch fails it reconstructs the payload from base64 chunks served via DNS TXT records under c[.]sdk[.]dl[.]wel1[.]ru. The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and launched as a detached background process (cmd.exe start /b or /bin/sh -c "... &"). Execution is gated by a filesystem timestamp stamp and can be suppressed by setting DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK.