twork-data-services-proxy-prime-api-v1-account-overdraft-info@20.7.4

Analysis

On require(), the package loads _adapter.js which fingerprints the host OS and architecture, then downloads a platform-specific binary payload from Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET /pkg/package. If HTTPS fails, it falls back to DNS TXT-based chunked data retrieval from c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (or dotnet_diag_<random>.exe on Windows), made executable, and spawned as a detached background process that outlives the parent. The package has no repository, no README, and no lifecycle hooks — the payload runs purely on require() via index.js's try/catch require of _adapter.js.