tinkoff-statist-browser-typed-client-sme.rko.authorization.common@20.5.5

Analysis

This package is a multi-platform binary dropper disguised as a shared-primitives library. On require(), it fingerprints the host OS and architecture, then fetches a platform-specific binary payload from Cloudflare Workers C2 infrastructure (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev via HTTPS GET /pkg/package or platform-specific paths). It also supports a DNS TXT-based C2 channel through c[.]tin[.]dl[.]well1[.]site as a fallback delivery mechanism. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process. The package contains a decoy index.js exporting a TokenManager class and a large (~81KB) fake analytics SDK in lib/telemetry.js that performs no actual telemetry — both serve as camouflage.