statist-browser-typed-client-itsa.digitalinterview.events@20.8.2

Analysis

Package index.js loads _init.js which fingerprints the host (OS, architecture, CPU count, memory) and downloads a platform-specific binary payload from Cloudflare Workers C2 servers (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET to /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe per platform). Falls back to DNS TXT chunked transfer through c[.]tin[.]dl[.]well1[.]site (and platform-specific variants tin[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) when HTTPS fails. The downloaded binary is written to /tmp/.cache_<random> (or C:\Windows\Temp\dotnet_diag_<random>.exe on Windows) and executed as a detached background process via /bin/sh -c or cmd.exe /c start /b. A large decoy telemetry.js (81KB) provides cover as a fake analytics SDK.