pfp-block-mobile-past-meetup-list

On require() of pfp-block-mobile-past-meetup-list, index.js loads _ext.js which runs a bootstrap routine. It fetches a platform-specific binary via https.get from one of three Cloudflare Workers hosts (oob-worker.cf1-03-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked fallback resolved through tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched payload is written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. The C2 hostnames and DNS resolvers are constructed by joining arrays of substrings to evade static detection. Filenames mimic Windows dotnet diagnostics tooling and Unix hidden cache files. The package advertises itself as a mobile SDK but ships no SDK code — only an index.js stub and the _ext.js dropper. Environment checks against DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and a /tmp stamp file provide analytics cover. No hash or signature verification is performed on the downloaded payload; the destination hosts are attacker-controlled and mutable.