tinkoff-statist-browser-typed-client-sme.users.origination.web@20.6.2

The package's main entry require()'s _loader.js, which at import time downloads a per-platform binary from string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT chunk-reassembly fallback over subdomains of dl.well1.site. The fetched bytes are written to a disguised path under /var/tmp or %TEMP% (e.g..cache_<hex> or dotnet_diag_<hex>.exe), chmod'd to 0755 via bracketed property access (fs["chmod"+"Sync"]), and executed detached via cp.spawn("/bin/sh", ["-c", path + " &"]) or cp.spawn("cmd.exe", ["/c", "start", "/b", path]). API names and hostnames are hidden behind array-join concatenation (require("child_"+"process"), ["oob-worker",".cf103-070.w","orkers.dev"].join("")) to evade static detection. A second copy of the dropper is shipped in lib/telemetry.js under an "Analytics SDK" cover story, using the same primitives (base64-chunk Buffer assembly, disk write, chmod 0755, /bin/sh spawn). The fetched payload is opaque, unpinned, unverified, and delivered from non-publisher-controlled infrastructure with a covert DNS channel; the destinations do not match the package's declared scope (a Tinkoff-branded internal typed client).