dolyame-boxy-atom-bnpl-store-button@20.5.3

Analysis

When required, the package loads _loader.js which fingerprints the host (platform, architecture, CPU count, memory, hostname) and downloads a platform-specific binary payload from Cloudflare Workers endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET to /pkg/package. If the HTTPS download fails, it falls back to DNS TXT-based chunked retrieval from c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random_hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random_hex>.exe (Windows) and spawned as a detached background process that outlives the parent. The package also contains a large decoy telemetry module (lib/telemetry.js) to appear legitimate.