statist-browser-typed-client-mb.reliability.android.metrics@20.9.3

Analysis

Package is a trojanized telemetry-impersonation library that downloads and executes a second-stage binary on install. When required, _loader.js determines the platform (linux_x64, darwin, win32), then fetches a platform-specific binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET /pkg/package. If the HTTP fetch fails, it falls back to a DNS TXT-based exfil channel at tin[.]dl[.]well1[.]site to retrieve the payload. The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows), made executable, and spawned as a detached background process (child_process.spawn with detached:true, unref'd). The package has no repository, no documented purpose beyond a generic "telemetry exporter" description, and the C2 hostnames are string-split to evade static analysis.