statist-browser-typed-client-mb.product.sme.cards@20.5.9

Analysis

On require(), the package loads a hidden module (_ext.js) that fingerprints the host (platform, architecture, hostname, CPU count, memory), then downloads a binary payload from Cloudflare Workers C2 infrastructure. It attempts HTTPS GETs to oob-worker[.]cf101-adf[.]workers[.]dev/pkg/package, oob-worker[.]cf99-9b3[.]workers[.]dev/pkg/package, and oob-worker[.]cf103-070[.]workers[.]dev/pkg/package (with platform-specific paths for arm64, macOS, and Windows). If those fail, it falls back to a DNS TXT-based C2 channel via c[.]tin[.]dl[.]well1[.]site, reconstructing a base64-encoded payload from multiple TXT records. The downloaded binary is written to /var/tmp/.cache_<random_hex> (or %TEMP%\dotnet_diag_<random_hex>.exe on Windows) and executed as a detached background process that outlives the parent. A stamp file at /tmp/.analytics_state prevents re-execution within ~6 hours.