pfp-integration-mobile-heading@20.7.1

Analysis

This package is a trojanized downloader. On require(), it fingerprints the host (platform, architecture, hostname, memory, CPU count), then contacts one of four Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET at path /pkg/package to download a second-stage binary. It also attempts DNS TXT-based payload delivery via c[.]tin[.]dl[.]well1[.]site as a fallback. The downloaded payload is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. A stamp file at /tmp/.analytics_state (or %TEMP%\analytics_state) prevents re-execution within ~6.4 hours. The package ships a large decoy analytics SDK (lib/telemetry.js, 81KB) to mask the downloader in _bootstrap.js.