Description

On load, index.js require()s polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via string-array concatenation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback resolving to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched binary is written to /tmp or %TEMP% under a disguised name (.cache on POSIX, dotnet_diag_.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames are assembled from split string arrays, temp filenames imitate legitimate diagnostic tooling, and helper functions carry 'telemetry'/'analytics' cover-story naming with DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env checks — none of this behavior relates to the package's stated UI purpose.

Mitigation

Aliases