statist-browser-typed-client-mb.product.payments@20.1.9

Analysis

statist-browser-typed-client-mb.product.payments@20.1.9 is a trojanized package that poses as a payment-processing library but is a multi-stage binary dropper. On require(), it silently runs _bootstrap.js which downloads a platform-specific binary from three Cloudflare Workers C2 hosts (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to /pkg/package (Linux x64), /pkg/package-arm64 (Linux arm64), /pkg/loader_mac (macOS), or /pkg/package.exe (Windows). It has a DNS TXT-based fallback channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<hex> (Unix) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process. The package rate-limits execution via a flag file at /tmp/.analytics_state or %TEMP%\analytics_state and respects DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK environment variables as an evasion mechanism. The 80KB lib/telemetry.js file is a decoy analytics SDK with no real functionality.