tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events @20.1.8

Summary

index.js requires./_polyfill on load, which selects a platform-specific endpoint, fetches an opaque binary from runtime-assembled Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS TXT fallback via *.dl.well1.site, writes it to /tmp or %TEMP% under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and detaches it via /bin/sh -c or cmd /c start. C2 domains are assembled from fragment arrays joined at runtime; require('child_process') is string-split; the drop path mimics system diagnostic components; the entire flow is wrapped under an 'Analytics SDK / telemetry' cover story. lib/telemetry.js ships a duplicate dropper (base64-decoded chunks, chmod 0755, cp.spawn('/bin/sh',['-c', filePath + ' &'])) that mirrors the same attack primitives. Any require() of this package executes attacker-controlled code on the installer's host.

Source: amazon-inspector (fc7dae6b0c575dcb758eec30a647592471c39ded904ff4ed379cadd93b4f6cf4)