Description

On require/import, bootstrap.js selects a platform-specific path (/pkg/package, /pkg/package.exe, /pkg/loader_mac, /pkg/package-arm64) and downloads an opaque native binary over HTTPS from author-controlled hosts whose names are reconstructed at runtime from string-split arrays: oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf101-adf.workers.dev. A fallback path reassembles a base64 payload from enumerated DNS TXT records under sdk.dl.wel1.ru (c./0./1./... subdomain enumeration). The fetched bytes are written to /tmp/.cache on Unix or %TEMP%/dotnet_diag_.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd. Any process that require()s the package immediately executes attacker-controlled native code with the installer's privileges; the string-splitting, filename masquerading as diagnostic caches, and DNS-TXT reassembly channel are active anti-analysis techniques rather than legitimate SDK behavior.

Mitigation

Aliases