tinkoff-boxy-desktop-mgm-product-filter@20.1.8

Analysis

On require(), the package executes a multi-platform binary dropper (_init.js). It fingerprints the OS and architecture, then attempts to download a platform-specific second-stage binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package (Linux x64), /pkg/package-arm64 (Linux arm64), /pkg/loader_mac (macOS), and /pkg/package.exe (Windows). If HTTPS fails, it falls back to DNS TXT record-based delivery via c[.]tin[.]dl[.]well1[.]site and related subdomains. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and spawned as a detached background process. A stamp file at /tmp/.analytics_state prevents re-infection within a 23-second window.