tinkoff-statist-browser-typed-client-sme.reporting.reporting@20.5.4

Analysis

Package is a trojanized downloader that executes on require(). It fingerprints the host platform/architecture, then attempts to download a second-stage binary from a rotating set of Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET requests to /pkg/package (or platform-specific paths like /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If HTTP download fails, it falls back to a DNS TXT-based C2 channel using domains tin[.]dl[.]well1[.]site (and platform variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) to reconstruct a base64-encoded payload. The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned as a detached background process. A state file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-execution within a 22,822-second window. The package ships a large decoy telemetry.js (81KB) to appear legitimate.