vvvedernikov-test-another-test@20.2.6

Analysis

On require(), the package executes _bootstrap.js which fingerprints the system (OS, architecture, hostname, CPU count, memory) and contacts Cloudflare Workers C2 servers (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) over HTTPS to download a platform-specific binary payload. It falls back to DNS TXT-based data retrieval via c[.]tin[.]dl[.]well1[.]site if the HTTP download fails. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or C:\Windows\Temp\dotnet_diag_<hex>.exe (Windows) and spawned as a detached background process that outlives the parent. A cache stamp file at /tmp/.analytics_state or C:\Windows\Temp\analytics_state prevents re-downloading within approximately 6 hours. The package also ships an 81KB decoy analytics SDK module (lib/telemetry.js) to mask its purpose.