devplatform-spa-plugin-feature-toggle@35.7.4

Analysis

devplatform-spa-plugin-feature-toggle@35.7.4 is a binary dropper disguised as a feature-toggle SDK. The main module (index.js) is a stub that immediately loads _support.js, which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, and oob-worker[.]cf103-070[.]workers[.]dev (paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If the HTTPS fetch fails, it falls back to reassembling the payload from DNS TXT records served by c[.]sdk[.]dl[.]wel1[.]ru (and sdk/ext/pkg/net[.]dl[.]wel1[.]ru). The downloaded binary is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe in %TEMP% on Windows), chmod 0755, and executed detached via /bin/sh -c "<path> &" or cmd.exe /c start /b so it outlives the parent. A marker file /tmp/.analytics_state throttles re-downloads. The package performs no legitimate feature-toggle function.