tinkoff-pfpa-tools

On require() of tinkoff-pfpa-tools, index.js loads _adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose names are assembled at runtime from split string fragments (oob-worker.cf102-baf.workers.dev, cf101-adf, cf103-070, cf99-9b3 under workers.dev), writes it to /tmp or %TEMP% under a decoy name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', filePath+' &'], {detached:true}) or the cmd equivalent. A '.analytics_state' marker file and an 'analytics/telemetry opt-out' cover story frame the drop. If HTTPS fetch fails, _adapter.js falls back to a DNS-TXT covert channel: it resolves c.<domain> for a chunk count and N.<domain> for each base64 chunk under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site, reassembles the payload, and executes it. A second, currently-unreferenced module lib/telemetry.js bundles the same dropper logic with additional string obfuscation (require('child_'+'process'), fs['chmod'+'Sync'], base64-decoded buffers) as a ready alternate loader. Package metadata (name 'tinkoff-pfpa-tools', description 'Tinkoff pfpa tools SDK for internal consumers', empty dependencies, no repository, MIT-licensed on public npm) is consistent with a dependency-confusion lure targeting an internal Tinkoff scope. Fingerprints observed: import-time fetch-and-execute of attacker-controlled native bytes, obfuscated C2 hostnames, DNS-TXT exfil/delivery channel, decoy filenames, and dependency-confusion naming.