tinkoff-terminal-kit-datetime@20.7.2

Analysis

tinkoff-terminal-kit-datetime is a combosquat of the legitimate tinkoff-terminal-kit package. On require(), it fingerprints the host OS and architecture (Windows, Linux, macOS, ARM64), then downloads a platform-specific binary payload from a rotating set of Cloudflare Workers C2 hosts (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If the HTTPS download fails, it falls back to a DNS TXT-based exfiltration channel via tin[.]dl[.]well1[.]site, where the payload is chunked and base64-encoded across multiple TXT records. The downloaded binary is written to /var/tmp/.cache_<random> (Unix) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. A filesystem-based cooldown mechanism prevents re-downloading within ~6 hours. The package has no repository, no README, and no lifecycle scripts — the payload runs silently on require().