statist-browser-typed-client-investing.product.loginandauthorization@20.7.3

Analysis

On require(), the package loads _bridge.js which fingerprints the host OS and architecture, then contacts three Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) over HTTPS to download a platform-specific binary payload. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows), made executable, and spawned as a detached background process. If the HTTPS download fails, the package falls back to a DNS TXT-based exfiltration channel via c[.]tin[.]dl[.]well1[.]site to reconstruct the payload from base64-encoded TXT records. A 20723-second cooldown prevents repeated downloads. The package has no repository, no meaningful README, and its sole purpose is to deliver and execute a remote second-stage binary.