fb-forms-form-boilerplate-contacts@20.7.1

Analysis

On require(), the package fingerprints the host OS and architecture (os.platform(), os.arch()), then attempts to download a second-stage binary payload from multiple Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths like /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If HTTPS fails, it falls back to a DNS TXT-based exfil channel using domains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) to reconstruct the payload from chunked TXT records. The downloaded binary is written to /tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows), made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "path &" on Linux). A filesystem stamp at /tmp/.analytics_state (or %TEMP%\analytics_state on Windows) rate-limits re-execution to once per ~6.4 hours. The package's index.js is a stub with no real functionality — its sole purpose is to require _init.js which runs the downloader.