hubert-react-query@20.6.8

Analysis

hubert-react-query@20.6.8 is a combosquat of the legitimate react-query library. On require(), it runs a multi-stage downloader: fingerprints the OS and architecture, then fetches a second-stage binary from Cloudflare Workers C2 hosts (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) via HTTPS GET /pkg/package (or platform-specific paths). If HTTP fails, it falls back to DNS TXT-based retrieval from c[.]tin[.]dl[.]well1[.]site (and platform-specific variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site), reassembling base64-encoded chunks. The downloaded payload is written to /var/tmp/.cache_<hex> (or C:\Windows\Temp\dotnet_diag_<hex>.exe on Windows) and executed as a detached background process via /bin/sh or cmd.exe. A cache file at /tmp/.analytics_state prevents re-download within ~6 hours. The package has no repository, no README, and no declared purpose matching its behaviour.