tinkoff-ui-action@20.5.7

Analysis

tinkoff-ui-action@20.5.7 is a combosquat binary dropper. On require(), _compat.js detects the OS/architecture (Windows, Linux x64, Linux ARM64, macOS) and downloads a native binary payload from attacker-controlled Cloudflare Workers infrastructure (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths). If HTTPS fails, it falls back to a DNS TXT-based chunked retrieval channel from the tin[.]dl[.]well1[.]site domain. The downloaded binary is written to /var/tmp/.cache_<random> on Linux/macOS or %TEMP%\dotnet_diag_<random>.exe on Windows, then executed as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Unix). A cache file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-download within approximately 6 hours.