sme-scripts-shared-library-webpack-plugin@20.2.9

Analysis

sme-scripts-shared-library-webpack-plugin@20.2.9 is a multi-stage binary downloader disguised as a webpack plugin. On require(), it fingerprints the host platform (OS, architecture, CPU count, memory) and downloads a second-stage binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET to /pkg/package. If HTTPS fails, it falls back to a DNS TXT-based chunked payload channel through c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. A stamp file at /tmp/.analytics_state (Linux) or %TEMP%\analytics_state (Windows) prevents re-infection within approximately 6.3 hours. The package has no repository, no README, and no lifecycle scripts — the payload runs on plain require().