sme-auth-core@20.9.2

Analysis

sme-auth-core@20.9.2 is a trojanized package that impersonates an identity-provider client library. When required, it silently loads a hidden dropper (_init.js) that fingerprints the operating system and architecture, then downloads a platform-specific second-stage binary from Cloudflare Workers C2 infrastructure (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) at paths /pkg/package (Linux x64), /pkg/package-arm64 (Linux arm64), /pkg/loader_mac (macOS), or /pkg/package.exe (Windows). If the HTTPS download fails, it falls back to a DNS TXT-based channel via tin[.]dl[.]well1[.]site, retrieving the payload in base64-encoded chunks over DNS TXT records. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Unix) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows) and executed as a detached background process. A stamp file at /tmp/.analytics_state (or %TEMP%\analytics_state) prevents re-execution within approximately 5.7 hours. The package contains a large decoy telemetry.js file (81KB) to obscure the 4.8KB dropper. No repository or documentation is provided.