deposits-overnight@20.8.5

Analysis

At require time, the package fingerprints the host (platform, architecture, hostname, CPU count, memory), then downloads a platform-specific binary payload from attacker-controlled Cloudflare Workers infrastructure. It attempts HTTPS GET requests to oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, and oob-worker[.]cf103-070[.]workers[.]dev at path /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe depending on platform). If HTTPS fails, it falls back to DNS TXT-based data retrieval via c[.]tin[.]dl[.]well1[.]site. The downloaded payload is written to /var/tmp/.cache_<random-hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and executed as a detached background process. The package has no repository, no README, and no declared purpose consistent with this behaviour.