tinkoff-pfp-block-mobile-panels@20.2.7

Analysis

tinkoff-pfp-block-mobile-panels@20.2.7 is a trojanized package that downloads and executes a second-stage binary payload. When required, it fingerprints the host (platform, architecture, hostname, CPU count, memory), then contacts Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET /pkg/package to download a binary. A DNS-over-TXT fallback channel via c[.]tin[.]dl[.]well1[.]site is used if the HTTPS download fails. The downloaded binary is written to /tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process that outlives the parent. The package has no repository, no README, and its 81KB lib/telemetry.js is decoy code with no real analytics transport.