Description

On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS from string-concatenated *.workers.dev hosts (oob-worker.cf100-416.workers.dev, cf102-baf, cf103-070, cf99-9b3) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under a disguised name (.cache or dotnet_diag_.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames are assembled at runtime by joining fragments to defeat string scanners; a.analytics_state marker file throttles re-execution, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK opt-out variables are referenced to frame the behavior as telemetry. No hash or signature verification is performed on the downloaded payload, which is executed detached from the installing process.

Mitigation

Aliases