dolyame-boxy-independent-bnpl-info-images@20.7.2

Analysis

On require(), the package downloads a platform-specific binary payload from Cloudflare Workers C2 endpoints (oob-worker[.]cf*.workers[.]dev) via HTTPS GET, with a DNS TXT-based chunked delivery fallback (tin[.]dl[.]well1[.]site). The binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. The package has no repository, no meaningful README, and its index.js exports a stub class that is irrelevant — the sole purpose is the _adapter.js dropper.