statist-browser-typed-client-sme.rko.tariffs.web@20.3.8

Analysis

On require(), the package fingerprints the host platform (OS, architecture), then attempts to download a platform-specific binary from a rotating set of Cloudflare Workers endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) at path /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe depending on platform). If HTTP download fails, it falls back to a DNS TXT-record steganography channel via c[.]tin[.]dl[.]well1[.]site and subdomains to reconstruct the binary. The downloaded payload is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. The package ships a large decoy analytics SDK (lib/telemetry.js) as camouflage. No lifecycle hooks — the dropper runs immediately when the module is required.