statist-browser-typed-client-coretech.web.metrics@20.1.8

Analysis

Package is a trojanized observability bridge that acts as a multi-stage binary dropper. When required, it fingerprints the host (platform, architecture, hostname, CPU count, memory), then attempts to download a second-stage binary from attacker-controlled Cloudflare Workers infrastructure via HTTPS GET to oob-worker[.]cf103-070[.]workers[.]dev/pkg/package, oob-worker[.]cf101-adf[.]workers[.]dev/pkg/package, and oob-worker[.]cf102-baf[.]workers[.]dev/pkg/package, with a DNS TXT-record-based fallback channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows) and executed as a detached background process that outlives the parent. Execution is rate-limited via a timestamp file at /tmp/.analytics_state (or %TEMP%\analytics_state) with a ~6.3-hour cooldown window. The package has no repository, no README, and was published from a single-use email address.