Description

On require() of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments (oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, with DNS fallback to *.dl.wel1.ru), fetch an opaque binary payload over HTTPS (base64 chunked, with a DNS-TXT fallback path), write the bytes to /tmp/.cache on Unix or %TEMP%\dotnet_diag_.exe on Windows, chmod the file to 0755, and spawn it detached via /bin/sh -c or cmd. Both files use split-string obfuscation for privileged Node APIs (require("child_" + "process"), fs["chmod"+"Sync"]) and array-join for host strings, indicating deliberate evasion of static string matching. The main export lib/telemetry.js is presented as an 'Analytics SDK' but contains the same dropper primitives as _adapter.js. The behavior fires unconditionally when the package is imported.

Mitigation

Aliases