tui-react-tooltip@20.5.4

Analysis

tui-react-tooltip@20.5.4 is a combosquat package that acts as a multi-stage binary downloader. On require, package/_loader.js fingerprints the host (platform, architecture, hostname, CPU count, total memory) then downloads a second-stage binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths). If HTTPS fails, it falls back to DNS TXT-record-based retrieval via c[.]tin[.]dl[.]well1[.]site. The downloaded payload is written to /var/tmp/.cache_<random> on Linux/macOS or %TEMP%\dotnet_diag_<random>.exe on Windows, then spawned as a detached background process. The package has no lifecycle scripts — the loader activates on require() via index.js.