twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer@20.5.3

Analysis

On require(), the package executes a multi-stage remote binary dropper. It fingerprints the OS/architecture, then attempts to download a platform-specific binary payload from a rotating set of Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths). If all HTTP downloads fail, it falls back to a DNS TXT-based exfiltration channel via tin[.]dl[.]well1[.]site, where the payload is reconstructed from base64-encoded TXT records. The downloaded binary is written to /var/tmp (or %TEMP% on Windows) with a randomized name (.cache_<hex> or dotnet_diag_<hex>.exe), made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c ... & on Linux/macOS) that outlives the parent process. The package also performs sandbox/environment detection by querying _leitwacht.attached.local. and respects DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env vars as an evasion mechanism.