twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info@20.5.1

Analysis

On require(), the package fingerprints the OS and architecture, then downloads a second-stage binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS at path /pkg/package. If HTTPS fails, it falls back to a DNS TXT-record chunked download from tin[.]dl[.]well1[.]site (and platform-specific variants). The downloaded payload is written to /var/tmp/.cache_<hex> (Linux) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and spawned as a detached background process. A state file at /tmp/.analytics_state prevents re-download within ~6.4 hours. The package has no lifecycle hooks — the dropper runs on require() via index.js requiring _helpers.js.