checkout-common-tokens@20.1.6

Analysis

checkout-common-tokens@20.1.6 is a trojanized package that downloads and executes a second-stage binary payload. On require(), the file _ext.js fingerprints the OS/architecture (linux_x64, darwin, win32) and fetches a platform-specific binary via HTTPS GET from Cloudflare Workers C2 infrastructure (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, path /pkg/package). It has a DNS TXT record-based fallback channel via c[.]tin[.]dl[.]well1[.]site for payload delivery. The downloaded binary is written to /tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and spawned as a detached background process with stdio ignored. The package's index.js is a decoy in-memory token manager; the malicious loader runs automatically via require('./_ext').