tinkoff-pfp-atom-styles-tiles@20.2.8

Analysis

Package is a combosquat binary downloader disguised as a UI component library. On require(), it fingerprints the host platform and architecture, then attempts to download a platform-specific binary from three Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS fails, it falls back to DNS TXT-record-based data transfer via c[.]tin[.]dl[.]well1[.]site and related subdomains. The downloaded binary is written to /var/tmp/.cache_<random_hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and spawned as a detached background process. A stamp file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-downloading within ~6 hours.