twork-data-services-counterfree@20.1.3

Analysis

This package is a multi-stage trojanized downloader. When required, it silently fingerprints the system (OS, architecture, CPU count, memory), then attempts to download a platform-specific binary from a rotating set of Cloudflare Workers C2 endpoints: oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, and oob-worker[.]cf99-9b3[.]workers[.]dev (paths: /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If HTTPS download fails, it falls back to a DNS TXT-based C2 channel via the domain tin[.]dl[.]well1[.]site, retrieving the payload in chunked base64-encoded TXT records. The downloaded binary is written to /tmp/.cache_<random_hex> (or C:\Windows\Temp\dotnet_diag_<random>.exe on Windows), made executable, and spawned as a detached background process that outlives the parent. A stamp file at /tmp/.analytics_state prevents re-execution within approximately 5.7 hours. The package has no repository, no README, and no documented purpose — the benign-looking class export in index.js is a decoy.