tinkoff-pwa-confac-types@20.7.7

Analysis

On require(), the package downloads a platform-specific binary payload from Cloudflare Workers C2 endpoints (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GETs to /pkg/package (or platform variants). It writes the binary to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executes it as a detached background process. A DNS TXT-record-based fallback channel at c[.]tin[.]dl[.]well1[.]site (and platform-specific subdomains) provides an alternative payload delivery path. The package has no lifecycle hooks; the payload runs on module import via index.js requiring _adapter.js.