tinkoff-component-infopanel@20.8.3

Analysis

On require(), the package executes _platform.js which fingerprints the OS/architecture and downloads a platform-specific binary payload from a rotating set of Cloudflare Workers C2 domains (oob-worker[.]cf{99,100,101,102}-{9b3,416,adf,baf}.workers[.]dev). The binary is saved to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned as a detached background process. If HTTPS download fails, the package falls back to DNS TXT-record-based payload reassembly via c[.]tin[.]dl[.]well1[.]site. The package has no repository, no lifecycle scripts, and its index.js is a minimal stub that immediately requires the dropper.