afisha-storybook-default@9.7.10

Analysis

On require(), the package detects the host platform (Linux x64/arm64, macOS, Windows) and downloads a platform-specific native binary from attacker-controlled infrastructure. The download URLs are constructed from string-split arrays pointing to oob-worker[.]cf (Cloudflare Workers) with paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, and /pkg/package.exe, with fallback resolvers on tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp (or %TEMP% on Windows) with a randomized filename and executed as a detached, hidden process via child_process.execFile(). The package also collects a host fingerprint (hostname, username, cwd, Node.js version, PID) before the download.