specials-obid-webpack

On require of the package, _vendor.js selects a URL path by host platform, downloads a binary over HTTPS from destination hostnames assembled at runtime via array `.join("")` string-splits (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a disguised temp path (`/tmp/.cache_<rnd>` on Unix, `%TEMP%\dotnet_diag_<rnd>.exe` on Windows), fs.chmodSync(savePath, 0o755), and spawns it detached via `spawn("/bin/sh",...)` or `spawn("cmd",...)`. A DNS-TXT covert-channel fallback reassembles base64 chunks from `*.dl.well1.site`. A parallel dropper implementation is bundled at lib/telemetry.js using the same DNS-base64 reassembly, `cp.spawn("/bin/sh", ["-c", filePath + " &"])`, and split identifiers (`"child_"+"process"`, `"chmod"+"Sync"`) under a telemetry cover story. Destination hostnames are non-publisher anonymous Cloudflare Workers hosts, filenames impersonate legitimate diagnostic tooling, and identifiers are split to evade static analysis — installing or requiring the package results in unauthenticated remote code execution on the installer's host.