evo-web-base-analytics-data@20.1.5

Analysis

On require(), the package fingerprints the host platform (os/arch) and downloads a platform-specific binary from one of three Cloudflare Workers C2 endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) via HTTPS GET at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS fails, it falls back to a DNS TXT-based download channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random_hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random_hex>.exe (Windows) and spawned as a detached background process that outlives the parent. A marker file at /tmp/.analytics_state or %TEMP%\analytics_state limits re-download frequency to roughly once per 6 hours. The package ships a large decoy telemetry module (lib/telemetry.js, 81KB) with plausible-looking but inert analytics code to disguise the payload.