twork-data-services-getting-arrests@20.1.1

Analysis

At install time, the package silently executes a binary dropper in _support.js. It fingerprints the host platform (os.platform + os.arch), then attempts to download a binary payload from a rotated set of Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET /pkg/package. If HTTPS download fails, it falls back to a DNS TXT-based retrieval channel via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows), made executable, and spawned as a detached background process that outlives the installer. The dropper rate-limits itself via a stamp file at /tmp/.analytics_state and respects DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK environment variables as an evasion mechanism. The package's index.js exports a decoy class with no real functionality.