twork-data-services-product-design-data@20.1.5

Analysis

On require(), the package's _loader.js collects the host platform and architecture, then attempts to download a binary payload from a rotating set of Cloudflare Workers C2 domains (oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) via HTTPS GET /pkg/package (or platform-specific variants). If HTTPS fails, it falls back to a DNS TXT-based exfil channel through c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) and spawned as a detached background process that outlives the parent. The package has no lifecycle hooks — the payload runs on require() via index.js's try { require('./_loader') } catch (_) {}.