terminal-kit-tslint-config@20.1.9

Analysis

terminal-kit-tslint-config is a combosquat package that functions as a multi-stage binary downloader. On require(), it loads _platform.js which beacons to a rotating set of Cloudflare Workers C2 endpoints (oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) to download a platform-specific binary payload (/pkg/package for Linux x64, /pkg/package-arm64 for Linux arm64, /pkg/loader_mac for macOS, /pkg/package.exe for Windows). If HTTPS download fails, it falls back to DNS TXT record exfiltration via c[.]tin[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and executed as a detached background process via cmd.exe /c start /b (Windows) or /bin/sh -c (Unix). The package also writes a cache stamp to /tmp/.analytics_state to avoid re-downloading within a cooldown period. It checks for sandbox/CI environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) as evasion.