pfp-forms-sme-loan@20.2.1

Analysis

pfp-forms-sme-loan@20.2.1 is a trojanized package that downloads and executes platform-specific second-stage binaries. On require(), _bridge.js fingerprints the host (OS, architecture, CPU count, memory), then attempts to download a binary from one of three Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on the platform. If direct download fails, it falls back to a DNS TXT-based covert channel using domains tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, or win[.]dl[.]well1[.]site to reassemble a base64-encoded payload. The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c <path> & on Unix) so it outlives the parent. The package also checks for a sandbox marker (_leitwacht.attached.local) and respects DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env vars as evasion countermeasures.