tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks@20.4.7

Analysis

This package is a multi-stage binary dropper disguised as a Tinkoff banking library. On require(), it fingerprints the host (platform, architecture, hostname, memory, CPU count) and attempts to download a platform-specific binary from multiple Cloudflare Workers C2 endpoints: oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, and oob-worker[.]cf100-416[.]workers[.]dev, all fetching /pkg/package (or platform variants /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If HTTP fails, it falls back to DNS TXT record exfiltration via tin[.]dl[.]well1[.]site (and platform-specific subdomains) to reconstruct the binary from chunked base64-encoded TXT records. The downloaded binary is written to /var/tmp/.cache_<random_hex> on Linux/macOS or %TEMP%\dotnet_diag_<random_hex>.exe on Windows, made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Unix) so it outlives the parent. A stamp file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-execution within ~6 hours. The package has no repository, no README, and was published by a single-use email address.