Description

On require(), [email protected] side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from split-string fragments (['oob-worker.cf101-adf.','wor','kers.dev'].join('')) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, fetch a platform-specific opaque binary (/pkg/package, /pkg/loader_mac, /pkg/package.exe), write it to /var/tmp/.cache or %TEMP%\dotnet_diag_.exe, apply mode 0755 via fs['chmod'+'Sync'], and spawn it detached through /bin/sh -c or cmd.exe /c start /b. child_process is loaded via require('child_'+'process') to evade static matching. There is no version pin, hash, or signature verification on the fetched executable. The dropper is duplicated inside lib/telemetry.js — the module referenced by index.js's module.exports — so the payload deploys even if adapter.js is removed. The 'telemetry'/'analytics_state'/'dotnet_diag' naming is a cover story; the behavior is remote-code execution on the installer at require() time.

Mitigation

Aliases