tinkoff-test-app-child-app@20.3.8

Analysis

On require(), the package loads _platform.js which downloads a platform-specific binary payload from Cloudflare Workers C2 infrastructure and executes it as a detached background process. The C2 endpoints are oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, and oob-worker[.]cf100-416[.]workers[.]dev, each serving /pkg/package (or platform-specific paths like /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) via HTTPS. A DNS TXT-based fallback channel uses c[.]tin[.]dl[.]well1[.]site (and related domains tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) to retrieve the payload when HTTPS is blocked. The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned with detached:true via cmd.exe /c start /b or /bin/sh -c "file &amp;". Execution is rate-limited to once per ~6.4 hours via a lockfile at /tmp/.analytics_state.