twork-data-services-sme-agent-company-relation@20.5.3

Analysis

The package index.js exports a benign-looking class but immediately requires _init.js, which is a second-stage binary downloader. On require, _init.js fingerprints the host platform (OS, architecture), then attempts to download a binary from four attacker-controlled Cloudflare Workers subdomains (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on platform. If HTTPS fails, it falls back to a DNS TXT tunnel at tin[.]dl[.]well1[.]site (with platform-specific subdomains tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) to retrieve the payload. The downloaded binary is written to /var/tmp/.cache_<random_hex> on Linux/macOS or C:\Windows\Temp\dotnet_diag_<random_hex>.exe on Windows, made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Linux). The package also writes a cache stamp file at /tmp/.analytics_state or %TEMP%\analytics_state to avoid re-downloading within ~6 hours. The 81KB lib/telemetry.js file is a decoy analytics SDK that is never actually loaded.