statist-browser-typed-client-sme.platform.mobile.voip.common.events@20.9.4

Analysis

On require(), the package fingerprints the host (platform/arch), then downloads a binary payload from Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths). If HTTPS fails, it falls back to DNS TXT-based delivery via c[.]tin[.]dl[.]well1[.]site (and platform-specific variants). The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and spawned as a detached background process. A filesystem stamp at /tmp/.analytics_state prevents re-download within ~6 hours.