tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events@20.2.5

Analysis

Combosquat package impersonating a Tinkoff internal library. On require(), _loader.js immediately fingerprints the host (platform, arch, CPU count, memory, hostname, CI environment), then downloads a platform-specific binary payload from one of four Cloudflare Workers C2 endpoints (oob-worker[.]cf*.workers[.]dev/pkg/package*). If HTTPS fails, it falls back to DNS TXT-based C2 via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and spawned as a detached background process that outlives the parent. The package also probes for sandbox detection by querying _leitwacht.attached.local.