twork-data-services-customer-api-v2-customer-vip-status@20.9.7

Analysis

On require(), the package fingerprints the host (platform, architecture, hostname, CPU count, total memory) and downloads a platform-specific binary payload from Cloudflare Workers C2 infrastructure. It attempts HTTPS GET requests to oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, and oob-worker[.]cf102-baf[.]workers[.]dev at path /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe depending on platform). If HTTP download fails, it falls back to DNS TXT-record-based C2 via c[.]tin[.]dl[.]well1[.]site (and platform-specific variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) — the TXT records encode a base64 payload chunked across multiple subdomains. The downloaded binary is written to /var/tmp/.cache_<random hex> (Linux) or %TEMP%\dotnet_diag_<random>.exe (Windows), made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Linux) that outlives the parent. A cache TTL of ~5.8 hours prevents re-download. The package contains a large decoy telemetry module with no real functionality. No repository or documentation is provided.