hubert-document-actual-insurance-rules-am@20.5.6

Analysis

A trojanized package that downloads and executes a second-stage binary on install. When required, it fingerprints the OS and architecture, then downloads a platform-specific binary from Cloudflare Workers C2 hosts (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET to /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe depending on platform). The downloaded binary is written to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows, then spawned as a detached background process. A DNS TXT-based fallback delivery channel via c[.]tin[.]dl[.]well1[.]site is also implemented. A cooldown flag file at /tmp/.analytics_state prevents re-download within approximately 5.6 hours.