accounts-timeline@9.6.10

Analysis

On require(), accounts-timeline silently downloads and executes a platform-specific binary from Cloudflare Workers subdomains (oob-worker[.]cf with subdomains 99-9b3[.]workers[.]dev through 103-070[.]workers[.]dev) with fallback DNS resolvers at tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site. The binary is fetched via HTTPS, written to /var/tmp (or C:\Windows\Temp on Windows) with a random filename, made executable, spawned as a detached background process via child_process.execFile, and then deleted after 5 seconds. The package collects a host fingerprint (hostname, username, cwd, Node.js version, PID) before downloading. Supported platforms: linux/x64, linux/arm64, darwin, win32.