twork-data-services-proxy-invest-symbols-list@20.4.6

Analysis

On require(), the package executes _init.js which fingerprints the OS/architecture and downloads a platform-specific binary payload from Cloudflare Workers hosts (oob-worker[.]cf*.workers[.]dev) via HTTPS GET to /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe per platform). It falls back to DNS TXT-tunneling through c[.]tin[.]dl[.]well1[.]site / tin[.]dl[.]well1[.]site if HTTPS fails. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process. A cooldown file at /tmp/.analytics_state prevents re-execution within ~6.4 hours.