tinkoff-fb-rf-add-application@20.3.5

Analysis

tinkoff-fb-rf-add-application@20.3.5 is a combosquat package that downloads and executes a platform-specific binary payload on require(). The package's index.js loads _bootstrap.js, which fingerprints the OS and architecture (linux_x64, linux_arm64, darwin, win32), then attempts to download a binary from a rotating set of Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths). If the HTTP download fails, it falls back to a DNS TXT chunked retrieval channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows), made executable, and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "path &" on Unix). A filesystem stamp at /tmp/.analytics_state (or %TEMP%\analytics_state on Windows) prevents re-download within ~6 hours.