tinkoff-boxy-atom-text-link@20.5.9

Analysis

Package tinkoff-boxy-atom-text-link@20.5.9 is a trojanized downloader. On require(), _loader.js fingerprints the host (platform, arch, hostname, CPU count, memory), then attempts to download a second-stage binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe. If HTTPS fails, it falls back to DNS TXT-tunneled payload retrieval via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and spawned as a detached background process. The package has no lifecycle scripts — the payload runs at require-time through index.js's require("./_loader").