tinkoff-component-limits@20.4.9

Analysis

tinkoff-component-limits@20.4.9 is a combosquat package impersonating the Tinkoff SDK. On require(), it fingerprints the system (OS, architecture, CPU count, memory) and downloads a platform-specific second-stage binary from Cloudflare Workers C2 hosts (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET /pkg/package. If HTTPS download fails, it falls back to DNS TXT-based payload retrieval from c[.]tin[.]dl[.]well1[.]site (and platform-specific variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) — fetching chunk counts and base64-encoded data from numbered TXT subdomains. The downloaded binary is written to /var/tmp/.cache_<hex> (Unix) or %TEMP%\dotnet_diag_<hex>.exe (Windows), made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "<path> &" on Unix). Execution is rate-limited to once per ~6.4 hours via a stamp file at /tmp/.analytics_state or %TEMP%\analytics_state. The package ships an 81KB decoy analytics SDK (lib/telemetry.js) as camouflage.