sme-crm-services-sme-crm-services-core@20.1.4

Analysis

Package sme-crm-services-sme-crm-services-core@20.1.4 is a combosquat binary dropper. On require(), it fingerprints the host (platform, architecture, hostname, CPU count, total memory) and downloads a binary payload from three Cloudflare Workers C2 endpoints (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) via HTTPS GET to /pkg/package, with random-order mirror rotation. If all HTTP downloads fail, it falls back to a DNS TXT-based data channel from c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows) and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "path &" on Unix). The package has no repository, no README, and no lifecycle hooks — the dropper activates on module import.