lifestyle-test-utils@20.7.2

Analysis

The package `lifestyle-test-utils` is a trojanized utility library that downloads and executes a platform-specific binary payload on install. The file `_ext.js` is loaded automatically via a try/catch require in `index.js`. It fingerprints the host (OS, architecture, hostname, CPU count, memory), then attempts to download a binary from a rotating set of Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) over HTTPS. If HTTPS download fails, it falls back to DNS TXT-record-based chunked payload delivery via domains under dl[.]well1[.]site (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows), made executable, and spawned as a detached background process using child_process.spawn with detached:true and stdio:ignore. A state file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-execution within ~5.5 hours.