accounts-loading-state@8.9.4

Analysis

accounts-loading-state@8.9.4 is a remote binary downloader disguised as a microservice utility. On require, it collects a host fingerprint (hostname, username, cwd, Node.js version, PID) and downloads a platform-specific binary from Cloudflare Workers-based C2 infrastructure (oob-worker[.]cf subdomains on workers[.]dev, with well1[.]site as fallback). The binary is written to /var/tmp (or %TEMP% on Windows), made executable, and spawned as a detached process that outlives the parent. Platform-specific download paths: /pkg/package (linux x64), /pkg/package-arm64 (linux arm64), /pkg/loader_mac (macOS), /pkg/package.exe (Windows). The C2 domains are constructed from split strings to evade static detection.