sso-tramvai-module-context-auth@20.4.5

Analysis

Combosquat package impersonating the Tramvai framework's auth module. On require(), _vendor.js fingerprints the host (platform/arch), then downloads a platform-specific binary payload from Cloudflare Workers C2 infrastructure (oob-worker.*.workers[.]dev) via HTTPS, with a DNS TXT-based fallback channel (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and executed as a detached background process via cmd.exe /c start /b or /bin/sh -c, with stdio ignored and the parent unref'd. The package has no lifecycle hooks but triggers the dropper synchronously on import.