accounts-forms@0.0.2

Analysis

accounts-forms@0.0.2 is a trojanized package that downloads and executes a remote binary on install. When required, _polyfill.js runs a bootstrap routine that: (1) fingerprints the OS and architecture (linux_x64, linux_arm64, darwin, win32); (2) attempts to fetch a platform-specific binary from one of four Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev/pkg/package, oob-worker[.]cf100-416[.]workers[.]dev/pkg/package, oob-worker[.]cf103-070[.]workers[.]dev/pkg/package, oob-worker[.]cf102-baf[.]workers[.]dev/pkg/package); (3) falls back to DNS TXT-record-based retrieval via c[.]tin[.]dl[.]well1[.]site if HTTP fails; (4) writes the downloaded payload to /var/tmp/.cache_<hex> (Linux) or %TEMP%\dotnet_diag_<hex>.exe (Windows); and (5) spawns it as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "path &" on Linux) so it persists after the parent exits. The package has no lifecycle hooks — the payload runs on require() via index.js's try { require('./_polyfill') } catch (_) {}.