tinkoff-boxy-desktop-two-panel-right-image@20.4.8

Analysis

On require(), the package loads _vendor.js which downloads and executes a second-stage binary payload. It detects the OS/architecture (linux_x64, linux_arm64, darwin, win32) and attempts to fetch a platform-specific binary from three Cloudflare Workers C2 hosts: oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, and oob-worker[.]cf102-baf[.]workers[.]dev, via HTTPS GET to paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If all Workers hosts fail, it falls back to DNS TXT-record-based retrieval from per-platform resolver domains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded binary is written to /var/tmp/.cache_<random-hex> (or C:\Windows\Temp\dotnet_diag_<random-hex>.exe on Windows), made executable, and spawned as a detached background process. A cache file at /tmp/.analytics_state (or %TEMP%\analytics_state on Windows) prevents re-downloading for approximately 6.4 hours. The package has no repository, no README, and its name is nonsensical — it is a trojanized downloader with no legitimate functionality.