a.poltoradnev-package-b@33.9.1

Analysis

On require(), the package runs a multi-stage binary downloader. It fingerprints the host platform and architecture, then downloads a platform-specific binary from Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS. If that fails, it reassembles a binary from DNS TXT records hosted on well1[.]site domains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded payload is written to /tmp/.cache_<random-hex> (or %TEMP%\dotnet_diag_<random-hex>.exe on Windows), made executable, and spawned as a detached background process that outlives the parent. A filesystem stamp at /tmp/.analytics_state prevents re-execution within ~6.3 hours.