time-webkit-tag@20.1.6

Analysis

At install/require time, the package downloads a second-stage binary payload from Cloudflare Workers C2 infrastructure and executes it as a detached background process. It fingerprints the host OS and architecture to select the appropriate payload variant, then attempts HTTPS download from three C2 hosts (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) at path /pkg/package. If HTTPS fails, it falls back to a DNS TXT record-based transfer channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows), made executable, and spawned as a detached background process that outlives the parent.