{"id":"MAL-2026-12243","summary":"Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f)\nOn require of the package's main entry, _vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under oob-worker.cfNNN-XXX.workers.dev (host strings assembled via split-and-join fragments to evade static analysis) and, on failure, reassembles a base64-encoded payload from sequential DNS TXT record lookups against subdomains of *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site). The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe,.analytics_state), chmod 0755, then spawned detached via `spawn('/bin/sh', ['-c', '\u003cfp\u003e &'])` on Unix or `spawn('cmd', ['/c','start','/b',...])` on Windows. There is no version pinning, no hash or signature verification, and comments frame the behavior as 'telemetry/analytics' unrelated to the package's advertised Tinkoff SDK prefill purpose. The DNS-TXT reassembly path is a covert delivery channel designed to bypass HTTPS egress filtering.\n","modified":"2026-08-05T10:06:40.980142415Z","published":"2026-08-05T09:03:21Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["20.2.3"],"id":"IN-MAL-2026-014525","import_time":"2026-08-05T09:28:22.105403192Z","modified_time":"2026-08-05T09:03:21Z","sha256":"d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tinkoff-fb-service-prefill-profile-contact/v/20.2.3"}],"affected":[{"package":{"name":"tinkoff-fb-service-prefill-profile-contact","ecosystem":"npm","purl":"pkg:npm/tinkoff-fb-service-prefill-profile-contact"},"versions":["20.2.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-fb-service-prefill-profile-contact/MAL-2026-12243.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"7d1109492f7f2a8996ec4792cbc45b0d942481d58cfd75236608f3c63ef3c1f4","tlsh":"9ab1a65606aa30188bf0dbe4cb17541af65be66333808294fb5ca9981f7312483b2dfc","path":"_vendor.js"}],"package_integrity":[{"filename":"tinkoff-fb-service-prefill-profile-contact-20.2.3.tgz","hashes":{"sha512_sri":"sha512-Rbdi9nFNfQuX/BKetLBy9Cc7BTJZopXix9trc7S5iS9aJhyfSgQP8j+/ILoxQnjvYRwIRpj8nlFIO+qnujq8oA==","sha1":"9ef273aed898092565b1eee2b9bd6b7f05dfced3"}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}