saas-f-lego-landings@20.7.5

Analysis

At runtime, the package downloads and executes a platform-specific second-stage binary from Cloudflare Workers C2 infrastructure. On require(), _support.js fingerprints the host (OS, architecture, hostname, CPU count, memory), then attempts to fetch a binary from three C2 servers: oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, and oob-worker[.]cf100-416[.]workers[.]dev, all at path /pkg/package (or platform-specific variants /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If HTTPS download fails, it falls back to a DNS TXT-based channel via c[.]tin[.]dl[.]well1[.]site (and platform variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) to reconstruct a base64-encoded payload. The downloaded binary is written to /var/tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows), made executable, and launched as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Linux/macOS) so it outlives the parent. A cooldown marker file at /tmp/.analytics_state prevents re-execution within ~6.5 hours. The package contains a large decoy file (lib/telemetry.js) with fake analytics SDK boilerplate to appear legitimate.