statist-browser-typed-client-social.shorts.editor@20.7.1

Analysis

Package auto-executes _runtime.js on require(), which downloads and runs a platform-specific remote binary payload. It constructs C2 hostnames from string fragments (oob-worker[.]cf{101,99,103,100}-{adf,9b3,070,416}.workers[.]dev) and fetches a binary from /pkg/package (or platform variants /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) over HTTPS. The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and spawned as a detached background process. A DNS-based fallback mechanism queries TXT records on tin[.]dl[.]well1[.]site (and platform-specific subdomains) to reconstruct a base64-encoded payload when HTTPS download fails. The package collects system information (platform, arch, hostname, CPU count, memory) before exfiltration.