pfp-block-mobile-steps@20.9.3

Analysis

pfp-block-mobile-steps@20.9.3 is a multi-stage binary downloader disguised as a platform adapter. When required, index.js silently loads _shim.js, which downloads and executes a second-stage binary from attacker-controlled infrastructure. The downloader contacts Cloudflare Workers C2 domains (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET to platform-specific paths (/pkg/package for Linux x64, /pkg/package-arm64 for Linux arm64, /pkg/loader_mac for macOS, /pkg/package.exe for Windows). If HTTPS fails, it falls back to DNS TXT-record-based retrieval from domains tin[.]dl[.]well1[.]site (and platform variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded binary is written to /var/tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows), made executable, and spawned as a detached background process. A stamp file at /tmp/.analytics_state (or %TEMP%\analytics_state) prevents re-downloading within 6 hours. The package also ships an 80KB decoy analytics SDK (lib/telemetry.js) that is never actually used.