tinkoff-pfp-integration-mobile-slider-icons@20.2.2

Analysis

Combosquat package impersonating a Tinkoff mobile slider icons library. On require(), _init.js detects the OS/architecture and downloads a platform-specific binary payload from Cloudflare Workers C2 endpoints (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev) via HTTPS GET /pkg/package. A DNS-based fallback channel via TXT record queries to c[.]tin[.]dl[.]well1[.]site retrieves the payload in chunked base64 when HTTPS fails. The downloaded binary is written to /var/tmp/.cache_* (Linux) or %TEMP%\dotnet_diag_*.exe (Windows) and spawned as a detached background process. A marker file at /tmp/.analytics_state prevents re-download within ~5.6 hours. The package's index.js exports a dummy class with no real functionality — the entire purpose is the _init.js downloader.