tinkoff-terminal-kit-carousel@20.6.3

Analysis

tinkoff-terminal-kit-carousel@20.6.3 is a combosquat binary dropper. On require(), it identifies the host platform/architecture and downloads a platform-specific binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to /pkg/package. If HTTPS fails, it falls back to DNS TXT-record-based payload reconstruction using the domains tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows) and executed as a detached background process via /bin/sh -c "path &" or cmd.exe /c start /b path. A cooldown marker at /tmp/.analytics_state (Linux) or %TEMP%\analytics_state (Windows) prevents re-download within approximately 6 hours. The package has no repository, no README, and no lifecycle hooks — the payload triggers automatically when the module is loaded via require("./_adapter") in index.js.