tinkoff-statist-browser-typed-client-eventea.projects.smartcam@20.6.3

Analysis

On require(), the package silently downloads and executes a platform-specific binary payload. It fingerprints the host (OS, architecture), then attempts to download a binary from a rotating set of Cloudflare Workers C2 hosts (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on the platform. The downloaded binary is saved to /tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random-hex>.exe (Windows), made executable, and launched as a detached background process that outlives the parent. If direct HTTPS download fails, it falls back to DNS TXT-based chunked payload delivery via c[.]tin[.]dl[.]well1[.]site. The package exports a decoy EventBus class while the malicious loader runs automatically on import.