arbocrate-sla-prober-arbocrate-sla-prober-core@7.5.8

Analysis

On require(), the package auto-executes a setup routine that fingerprints the host (hostname, username, cwd, Node.js version, PID) and detects the platform (Linux x64/arm64, macOS, Windows). It then connects to attacker-controlled hosts (oob-worker[.]cf, well1[.]site) to download a platform-specific binary, writes it to /var/tmp (or C:\Windows\Temp on Windows), makes it executable, and spawns it as a detached child process. The binary download is wrapped inside a large analytics-SDK facade (lib/telemetry.js) that provides HTTPS transport, endpoint rotation, and DNS-based failover to multiple CDN nodes. The package has no lifecycle hooks — execution happens on require() via process.nextTick.