statist-browser-typed-client-hra.workplacer.events@20.9.1

Analysis

Package is a trojanized event-emitter that, when required, downloads and executes a binary payload. The entry point (index.js) loads _polyfill.js, which resolves the platform (linux_x64, linux_arm64, darwin, win32) and attempts to fetch a binary from one of four Cloudflare Workers C2 endpoints (oob-worker[.]cf*.workers[.]dev) over HTTPS. If HTTPS fails, it falls back to DNS TXT-based data retrieval from domains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) to reconstruct a base64-encoded payload. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows), made executable, and launched as a detached background process (spawned with detached:true, stdio:ignore, unref'd). A cooldown marker file (/tmp/.analytics_state or %TEMP%\analytics_state) prevents re-execution within ~20 seconds. The package ships a large decoy telemetry SDK (lib/telemetry.js, 81KB) to appear legitimate.