nxify-unic@20.3.2

Analysis

On import, nxify-unic@20.3.2 executes a binary dropper. The package's index.js requires _shim.js, which fingerprints the operating system and architecture, then downloads a platform-specific binary payload from attacker-controlled Cloudflare Workers endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET requests to /pkg/package. If the HTTP download fails, it falls back to a DNS TXT-based channel using domains tin[.]dl[.]well1[.]site and variants. The downloaded binary is written to /var/tmp/.cache_<randomhex> (Linux/macOS) or %TEMP%\dotnet_diag_<randomhex>.exe (Windows) and executed as a detached background process — cmd.exe /c start /b on Windows, /bin/sh -c "path &" on Unix. The package also ships an 81KB decoy analytics SDK (lib/telemetry.js) to appear legitimate. The dropper rate-limits itself to once per ~5.6 hours via a cache file.