ded-pwa-ded-pwa-core@35.6.3

Analysis

ded-pwa-ded-pwa-core is a decoy "platform core" package whose index.js requires _adapter.js, which on load fingerprints the host platform/arch and downloads a second-stage binary from Cloudflare Workers CDN endpoints (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) at /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe per platform). If HTTPS fails it falls back to DNS-chunked retrieval via TXT records under c[.]sdk[.]dl[.]wel1[.]ru. The downloaded payload is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe on Windows), chmod 755, and executed detached via /bin/sh or cmd.exe. A cooldown stamp file (.analytics_state) throttles re-downloads. The same downloader logic is duplicated in lib/telemetry.js.