saas-f-testing@20.4.2

Analysis

saas-f-testing@20.4.2 is a multi-stage downloader. On require(), index.js loads setup.js which fingerprints the platform and architecture (linux/arm64, darwin/x64, win32/x64, etc.), then downloads a platform-specific binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS download fails, it falls back to a DNS TXT-based C2 channel using domains tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site to reconstruct a base64-encoded payload. The downloaded binary is written to /tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and executed as a detached background process via /bin/sh -c "path &" or cmd.exe /c start /b. A cooldown marker at /tmp/.analytics_state (or %TEMP%\analytics_state) prevents re-execution within ~6 hours. The package has no repository, no README, and no lifecycle scripts — the payload runs purely through the require() chain.