tinkoff-ui-action@20.5.7

On require of the package's main entry, _compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembled at runtime via Array.join to evade static analysis (e.g. oob-worker.cf*.workers.dev), with a DNS-TXT chunked-base64 fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under cover filenames such as dotnet_diag_<hex>.exe and.cache_<hex>, chmodded 0755 on POSIX, and detached-spawned via /bin/sh -c '<path> &' or cmd.exe /c start /b <path>. lib/telemetry.js contains the same download-write-chmod-spawn pattern with obfuscated require("child_"+"process") and fs["chmod"+"Sync"] under an 'Analytics SDK' cover, providing a secondary payload runner. There is no hash or signature verification, no user consent, and the package is advertised as a React UI component library — a purpose unrelated to fetching and executing native binaries. Runtime string-splitting of both hostnames and dangerous API names is deliberate anti-analysis.