{"id":"MAL-2026-12254","summary":"Malicious code in tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (801b453825e385d0c0c659b2037a6f8fcbcdfa0c0ae519ae103280639cd8ed99)\nPackage name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./_init on load; _init.js selects a platform-specific endpoint whose hostnames are reconstructed at runtime by joining string fragments (e.g. [\"oob-wo\",\"rker.cf103-070.\",\"workers.de\",\"v\"].join(\"\") and ['tin.dl.well1.','site'].join(\"\")), fetches an opaque binary over HTTPS from anonymous *.workers.dev hosts, writes it to a temp path under a cover name (.cache_\u003chex\u003e / dotnet_diag_\u003chex\u003e.exe), chmods 0755, and spawns it detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd.exe start /b. When HTTPS fetches fail, a DNS-TXT covert channel queries c.\u003cdomain\u003e for a chunk count, iterates n.\u003cdomain\u003e TXT records under *.dl.well1.site, base64-concatenates the parts, and feeds the reconstructed buffer through the same write/chmod/spawn path. lib/telemetry.js mirrors the same write/chmod/spawn primitives. The destinations are not the declared publisher, no hash or signature is verified, and the hostname obfuscation and cover-naming serve only to evade static inspection.\n","modified":"2026-08-05T10:06:46.385126130Z","published":"2026-08-05T08:59:23Z","database_specific":{"malicious-packages-origins":[{"versions":["20.4.1"],"id":"IN-MAL-2026-014498","import_time":"2026-08-05T09:28:19.003946255Z","modified_time":"2026-08-05T08:59:23Z","sha256":"801b453825e385d0c0c659b2037a6f8fcbcdfa0c0ae519ae103280639cd8ed99","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica/v/20.4.1"}],"affected":[{"package":{"name":"tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica","ecosystem":"npm","purl":"pkg:npm/tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica"},"versions":["20.4.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-UulcaPYQ5bZwKNVqLD+a8qQ0f75sNwwOSSttmk7FgZ8Og99hAc35SEBLzO3DwutrXJ24cCvaKpTHYMoMB1wcBg==","sha1":"b5affabb7951e646460e1f1c0254beb5883b61d9"},"filename":"tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica-20.4.1.tgz"}],"evidence_files":[{"tlsh":"d1b1c79a126a311c4bb097e587175815f55af66337808290fa9c9ac41fb7034c3b1efc","path":"_init.js","sha256":"b9beb7ec49dd0327cca544664b6f8dadb1e1daf2632ad71bbb8ae890c3108c12"},{"path":"package.json","sha256":"72888e1c42e345f87e8c54517299c40c83b63673a46e2d8ca3ec094ae3e51ca3","tlsh":"ded0a75706219cb309f652504ce2d562f3a31f1fa02adc0e75775518429037b04af334"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica/MAL-2026-12254.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}