statist-browser-typed-client-risktech.uwfrontantifraud.events@20.1.5

Analysis

Package is a multi-platform binary dropper disguised as a domain event handler. On require(), it fingerprints the host (platform/arch), then downloads a platform-specific binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET /pkg/package (or /pkg/package-arm64 for ARM Linux, /pkg/loader_mac for macOS, /pkg/package.exe for Windows). If HTTPS fails, it falls back to a DNS TXT-based channel using c[.]tin[.]dl[.]well1[.]site (and platform variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) to reconstruct a base64-encoded payload from TXT records. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or C:\Windows\Temp\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process. A cooldown flag file at /tmp/.analytics_state prevents re-downloading within ~6 hours. The package ships an 81KB decoy analytics SDK (lib/telemetry.js) to appear legitimate.