shopping-shared-atom-mobile-cart-counter@20.6.6

Analysis

shopping-shared-atom-mobile-cart-counter@20.6.6 is a trojanized package that deploys a multi-stage binary downloader. On require(), package/_loader.js fingerprints the host (platform, architecture, hostname, CPU count, memory), then attempts to download a binary payload from four Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on the OS. If HTTPS fails, it falls back to DNS TXT-based retrieval from c[.]tin[.]dl[.]well1[.]site, reassembling base64-encoded chunks. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process via cmd.exe /c start /b (Windows) or /bin/sh -c "path &" (Linux/macOS). The package has no repository, no README, and no lifecycle scripts — the payload runs silently on import via index.js's require("./_loader").