twork-mf-e2e-nitro@20.8.5

Analysis

twork-mf-e2e-nitro@20.8.5 is a trojanized npm package that downloads and executes a second-stage binary payload on the installer's machine. When the package is required (via index.js → _compat.js), it fingerprints the operating system and architecture, then attempts to download a platform-specific binary from one of three Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS fails, it falls back to a DNS TXT-record-based payload retrieval from c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /tmp/.cache_<random-hex> (Unix) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows) and executed as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c <path> & on Unix). A cooldown marker file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-download within approximately 5.8 hours. The package has no repository, no README, and no lifecycle hooks — the dropper runs synchronously when the module is loaded.