tinkoff-statist-browser-typed-client-leasing.admin.events@20.7.7

Analysis

A trojanized package that downloads and executes a platform-specific binary payload on the victim's machine. When the module is loaded (via require), _helpers.js runs a bootstrap routine that: (1) checks for opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a lock file at /tmp/.analytics_state or %TEMP%\analytics_state; (2) fetches a binary from one of three Cloudflare Workers C2 hosts (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on platform; (3) if HTTP fetch fails, falls back to a DNS TXT-based exfiltration channel via domains tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, or win[.]dl[.]well1[.]site; (4) writes the downloaded binary to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows); and (5) executes it as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Unix). The package ships a decoy EventBus class in index.js and a large fake analytics SDK in lib/telemetry.js to appear legitimate.