tinkoff-statist-browser-typed-client-sme.compliance.web.events@20.4.4

Analysis

Combosquat package impersonating a Tinkoff internal event-bus library. On require(), _init.js fingerprints the host (platform, architecture, hostname, CPU count, memory), then downloads a binary payload from Cloudflare Workers C2 servers (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET /pkg/package. If HTTPS fails, it falls back to DNS TXT-record-based payload delivery via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and spawned as a detached background process. The package has no lifecycle scripts — the payload runs on require() via index.js -> require('./_init').