tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics@20.2.7

Analysis

Combosquat package targeting Tinkoff's internal naming scheme. At require() time, _vendor.js fingerprints the host (platform, arch, hostname, CPU count, memory), then downloads a platform-specific second-stage binary from Cloudflare Workers C2 domains (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) over HTTPS with a node-fetch/2.6 User-Agent. The binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "path &" on Unix). A stamp file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-download within ~5.9 hours. If HTTPS download fails, a DNS TXT fallback channel via c[.]tin[.]dl[.]well1[.]site retrieves the payload via base64-encoded TXT records. The package has no lifecycle hooks — execution triggers on require() via index.js's try/catch require("./_vendor").