tinkoff-boxy-desktop-features-banner @20.2.4

Summary

The package's main entry (index.js) requires./setup at load time. setup.js assembles obfuscated Cloudflare Workers hostnames via array-join concatenation (e.g. oob-worker.cf99-9b3.workers.dev, cf103-070/cf102-baf/cf101-adf.workers.dev) with a DNS TXT fallback resolving through tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, downloads a platform-specific binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under a disguised filename, chmods it to 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) (or cmd on Windows). A second module lib/telemetry.js (framed as an 'Analytics SDK') bundles the same dropper primitives with additional evasion (require('child_' + 'process'), fs['chmod' + 'Sync']). The remote destinations, obfuscated hostname assembly, and executed payload are unrelated to the package's stated 'features banner' purpose.

Source: amazon-inspector (9792640803b7c90320c995d134baefcd36a52037d1947a3c0262c9d9e5ada168)