twork-products-taiga2-products-timeline@20.6.1

Analysis

On require(), the package silently fingerprints the host (platform, architecture, hostname, CPU count, memory) and downloads a platform-specific binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) at path /pkg/package. If HTTPS is blocked, it falls back to DNS TXT chunked transfer via c[.]tin[.]dl[.]well1[.]site. The downloaded payload is written to /var/tmp/.cache_<random> (Linux) or C:\Windows\Temp\dotnet_diag_<random>.exe (Windows, masquerading as a .NET diagnostics tool), made executable, and spawned as a detached background process that outlives the parent. The package's lib/telemetry.js (80KB) is a decoy analytics SDK that is never actually used — the malicious behaviour is in _bridge.js.