{"id":"MAL-2026-12233","summary":"Malicious code in tinkoff-boxy-independent-kasko-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc)\nOn require of the package, index.js loads _bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfuscation and downloads a platform-specific binary from Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev). If HTTPS mirrors fail, resolveDns() reads a chunk count from c.\u003cdomain\u003e TXT records and fetches base64-encoded payload chunks from N.tin.dl.well1.site TXT records, reassembling them into an executable. The payload is written to /tmp or %TEMP% under disguised filenames (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmod 0755, and spawned detached via cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"]) or cmd equivalent on Windows. The package name references an unrelated 'kasko form' library, unrelated to the dropper behavior. lib/telemetry.js ships a second copy of the same drop-and-exec logic under an 'analytics SDK' cover story.\n","modified":"2026-08-05T10:06:36.209170890Z","published":"2026-08-05T09:04:10Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014531","import_time":"2026-08-05T09:28:22.641510359Z","modified_time":"2026-08-05T09:04:10Z","sha256":"873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc","source":"amazon-inspector","versions":["20.1.3"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tinkoff-boxy-independent-kasko-form/v/20.1.3"}],"affected":[{"package":{"name":"tinkoff-boxy-independent-kasko-form","ecosystem":"npm","purl":"pkg:npm/tinkoff-boxy-independent-kasko-form"},"versions":["20.1.3"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"1a9c70ce3e5628d44b68dc24981123d0a85ba669622da060d0a06b9ad94ef02d","tlsh":"a8a1b79a12a570198b70dbe4c7178826f66af6633381c2c0f79c59944f736248371efc","path":"_bootstrap.js"},{"path":"lib/telemetry.js","sha256":"912fb5e84544b5d2e801283de9f9d30e4c5bc3377d936141a751eb6b6ca52ee7","tlsh":"18834055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"tinkoff-boxy-independent-kasko-form-20.1.3.tgz","hashes":{"sha1":"f73cf59673345595cc6b3a3465152a3077868922","sha512_sri":"sha512-SnvG+C8CVgHbYx2OOVRCeUtH+vcUNfWrMNFRKLrzdMyojEb07x8d670/GTkGrXAZczsSzx04XOLJTTDTmyE2PQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-boxy-independent-kasko-form/MAL-2026-12233.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}