tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events @20.9.9

Summary

Package main entry require()'s./_adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string array-join, downloads a platform-specific binary (with a DNS TXT base64 reassembly fallback that enumerates c.<domain> for a count and then 0.<domain>..N.<domain> for chunked payload parts), writes it to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. A second dropper in lib/telemetry.js repeats the pattern under an 'Analytics SDK' cover story, using require('child_'+'process'), fs['chmod'+'Sync'], base64 chunk assembly, and cp.spawn('/bin/sh',['-c', filePath+' &'],{detached:true}). Destinations and API surfaces are constructed at runtime via string-splitting to evade static scanners. No binding.gyp, no publisher-owned host, no version pinning, no hash verification, and the cover-story naming (dotnet_diag, extension, Analytics SDK) does not match any documented package purpose.

Source: amazon-inspector (ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0)