tinkoff-ui-angular-addon-wysiwyg@20.7.8

Analysis

Combosquat package impersonating a Tinkoff UI library. On require, it collects the host platform and architecture, then downloads a second-stage binary from attacker-controlled Cloudflare Workers endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) at path /pkg/package. It also uses a DNS TXT-record-based fallback delivery channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and executed as a detached background process. A stamp file at /tmp/.analytics_state (or %TEMP%\analytics_state on Windows) prevents re-download for approximately 6.3 hours.