sme-rko-finance-front-operations-providers

On require() of the package, index.js loads _bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments (oob-worker.cf103-070.workers.dev, cf100-416, cf101-adf.workers.dev) and downloads a platform-specific binary via https.get. The fetched bytes are written to a decoy path under /tmp or %TEMP% (.cache_<hex>/dotnet_diag_<hex>.exe), chmod 0755 on Unix, and executed detached via spawn("/bin/sh",["-c", fp+" &"]) or spawn("cmd",...) on Windows. A DNS-TXT fallback channel resolves shards from wel1.ru (sdk.dl.wel1.ru assembled from fragments) — a count record c.<domain> followed by numeric shards <i>.<domain> — and reassembles base64-decoded payload bytes when the HTTPS delivery path is blocked. Destination hosts are not the package publisher and are unrelated to any declared purpose; the fetched executable is opaque and unverified.