accounts-card-design-picker@0.0.2

Analysis

accounts-card-design-picker@0.0.2 is a trojanized npm package that downloads and executes a platform-specific binary payload. On require(), index.js loads _platform.js which: (1) detects the OS and architecture; (2) attempts HTTPS GET requests to three Cloudflare Workers C2 endpoints — oob-worker[.]cf101-adf[.]workers[.]dev/pkg/package, oob-worker[.]cf99-9b3[.]workers[.]dev/pkg/package, and oob-worker[.]cf103-070[.]workers[.]dev/pkg/package — to download a binary; (3) falls back to DNS TXT-based binary retrieval via c[.]tin[.]dl[.]well1[.]site if the HTTP downloads fail; (4) writes the downloaded binary to /var/tmp/.cache_<random_hex> on Linux/macOS or %TEMP%\dotnet_diag_<random_hex>.exe on Windows; (5) spawns it as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Unix). A marker file at /tmp/.analytics_state prevents repeated downloads within a TTL window. The package also ships an 81KB decoy analytics SDK (lib/telemetry.js) as camouflage. The binary payload is attacker-controlled and can be updated at any time.