tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web@20.3.8

Analysis

Package tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web@20.3.8 is a combosquat trojan that downloads and executes a platform-specific binary payload. On require(), the file package/_bridge.js silently runs: it fingerprints the OS and architecture (Windows, macOS, Linux x64/arm64), then attempts to download a binary from a rotating set of Cloudflare Workers C2 hosts (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS download fails, it falls back to a DNS TXT-based exfiltration channel via c[.]tin[.]dl[.]well1[.]site and platform-specific subdomains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned as a detached background process. A cooldown mechanism prevents re-downloading within ~5.8 hours. The package has no repository, no README, and no lifecycle scripts — the payload runs on module load.