accounts-appointment@33.2.6

Analysis

On require(), the package auto-executes a second-stage binary downloader. It fetches a platform-specific binary from Cloudflare Workers endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) with DNS TXT-record-based fallback C2 (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded payload is written to /var/tmp/.cache_<random> (Linux) or %TEMP%\dotnet_diag_<random>.exe (Windows) and executed as a detached background process. The package ships a decoy 81KB analytics SDK (lib/telemetry.js) to mask the malicious setup.js loader.