platform-ui-island@20.5.9

Analysis

platform-ui-island@20.5.9 is a trojanized package that downloads and executes a platform-specific binary payload on install. The entry point (index.js) loads _bridge.js, which fingerprints the OS and architecture, then fetches a binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS. It has a DNS TXT-chunked fallback channel through tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_* (Linux/macOS) or %TEMP%\dotnet_diag_*.exe (Windows) and spawned as a detached background process that outlives the parent. A cache file at /tmp/.analytics_state (or %TEMP%\analytics_state) prevents re-download within ~6 hours.