fry-page-maker-types@20.6.4

Analysis

The package exports a benign-looking class but silently runs a multi-stage binary downloader on require(). It fingerprints the host OS and architecture, then downloads a binary payload via HTTPS from Cloudflare Workers endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) at path /pkg/package. If HTTPS download fails, it falls back to retrieving the payload chunked over DNS TXT records from c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows) and spawned as a detached background process. A cache marker at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-downloading for ~5.5 hours. The package checks DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK environment variables as a cover opt-out mechanism.