platform-ui-codemods@20.6.7

Analysis

platform-ui-codemods@20.6.7 is a trojanized package that downloads and executes a second-stage binary payload on installation. When required, _compat.js fingerprints the system (OS, architecture, CPU count, memory), then fetches a platform-specific binary from one of four Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET /pkg/package. If HTTPS download fails, it falls back to reconstructing a payload from DNS TXT records queried against c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<hex> (Unix) or C:\Windows\Temp\dotnet_diag_<hex>.exe (Windows), made executable, and launched as a detached background process. A cooldown file at /tmp/.analytics_state prevents re-download within ~6 hours. The package has no repository, no lifecycle scripts in package.json, and its index.js silently requires the malicious _compat.js module on import.