peter-desktop-peter-big-column@20.3.2

Analysis

On require, the package silently fingerprints the host platform (OS, architecture, CPU count, memory) and attempts to download and execute a platform-specific binary payload. It connects to multiple Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) over HTTPS, requesting /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe depending on platform). If HTTPS is blocked, it falls back to DNS TXT-record chunked transfer via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random> (Linux) or %TEMP%\dotnet_diag_<random>.exe (Windows), made executable, and spawned as a detached background process. A filesystem lockfile at /tmp/.analytics_state (or %TEMP%\analytics_state on Windows) prevents re-execution within a cooldown window.