tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci@20.1.2

Analysis

On require, the package silently downloads a binary payload from Cloudflare Workers C2 infrastructure and executes it as a detached background process. The package name mimics internal Tinkoff package naming conventions (dependency-confusion). The dropper in _loader.js fingerprints the OS and architecture, then fetches a binary from one of four C2 hosts (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths). The binary is written to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows, made executable, and spawned detached (cmd.exe /c start /b on Windows, /bin/sh -c "fp &" on Linux). A DNS TXT-based fallback mechanism using c[.]tin[.]dl[.]well1[.]site (and platform-specific variants tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) provides alternative data retrieval. The package has no lifecycle hooks — the payload runs synchronously on require via index.js silently loading _loader.js.