tinkoff-codeceptjs-storyshots@20.7.8

Analysis

tinkoff-codeceptjs-storyshots is a combosquat package impersonating an internal Tinkoff/CodeceptJS module. On require(), it silently downloads and executes a platform-specific binary payload. It detects the OS and architecture (linux_x64, linux_arm64, darwin, win32), then fetches a binary from one of three Cloudflare Workers C2 hosts (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths). If HTTP download fails, it falls back to DNS TXT-based chunked delivery via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random> (Linux) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned as a detached background process. A state file at /tmp/.analytics_state prevents re-download within ~6.25 hours. The package ships an 81KB decoy analytics SDK (lib/telemetry.js) that is never executed.