aasp-tent-aasp-tent-core@0.0.2

Analysis

On require(), the package detects the host OS and architecture (Windows, Linux x64/arm64, macOS), then downloads a platform-specific binary from one of three Cloudflare Workers endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) over HTTPS, with a DNS TXT-record-based fallback using domains tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random_hex> (or %TEMP%\dotnet_diag_<random_hex>.exe on Windows), made executable, and spawned as a detached background process with stdio ignored. A marker file at /tmp/.analytics_state (or %TEMP%\analytics_state) prevents re-execution within a window. The package has no repository, no lifecycle hooks, and its stated purpose as a "platform core" is inconsistent with the binary downloader behaviour.