tinkoff-pfp-block-desktop-tabs

On require, index.js loads _ext.js which reconstructs endpoint hostnames from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, plus DNS-TXT fallbacks at tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site), downloads a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it to 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &']) or cmd. No hash or signature verification is performed. A secondary bundled module lib/telemetry.js (~81KB) uses the same base64-decode + chmod 0755 + /bin/sh spawn shape with obfuscated require('child_'+'process') and fs['chmod'+'Sync'] concatenation. The package name impersonates the Tinkoff brand with no legitimate relationship, and dropped filenames (dotnet_diag_*.exe,.analytics_state) mimic Microsoft diagnostics artifacts to blend in.