checkout-create-pos-order-am@20.9.5

Analysis

checkout-create-pos-order-am@20.9.5 is a combosquat package that drops and executes a platform-specific binary payload. On require(), index.js loads _support.js which fingerprints the OS/arch, then downloads a binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GETs to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS fails, it falls back to a DNS TXT-based download channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and spawned as a detached background process. A filesystem stamp at /tmp/.analytics_state prevents re-download within ~6 hours.