tinkoff-boxy-mobile-documents@20.1.7

Analysis

Combosquat package impersonating a mobile-documents SDK. On require(), _platform.js fingerprints the OS/architecture (linux_x64, darwin, win32) and downloads a platform-specific binary payload from Cloudflare Workers C2 endpoints (oob-worker.cf1*.workers[.]dev) via HTTPS. The downloaded payload is written to /tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and executed as a detached background process that outlives the parent. A fallback DNS TXT-based C2 channel (c[.]tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) is used if the HTTPS download fails. The package has no repository, no lifecycle scripts in manifest, and no README — the payload runs purely through code evaluation at require time.