{"id":"MAL-2026-12271","summary":"Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4)\nThe package is presented as a trivial event emitter but its main entry (index.js) auto-loads _bootstrap.js on require(). _bootstrap.js selects a per-platform payload URL, downloads a native binary over HTTPS from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64 fallback via tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes the binary to /tmp or %TEMP% under cover-story filenames (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe. C2 hostnames are reconstructed at runtime by.join() on split fragments to hide them from string search, and execution is gated behind a /tmp marker TTL plus opt-out-shaped env vars (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) as cover. Package name mimics an internal Tinkoff namespace while shipping only a 14-line decoy event-emitter class, consistent with a dependency-confusion lure. Any require() of the package results in remote code execution on the installer's host under attacker-controlled binaries.\n","modified":"2026-08-05T10:06:54.190847656Z","published":"2026-08-05T08:58:02Z","database_specific":{"malicious-packages-origins":[{"versions":["20.9.9"],"id":"IN-MAL-2026-014490","import_time":"2026-08-05T09:28:18.078963548Z","modified_time":"2026-08-05T08:58:02Z","sha256":"48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events/v/20.9.9"}],"affected":[{"package":{"name":"tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events","ecosystem":"npm","purl":"pkg:npm/tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events"},"versions":["20.9.9"],"database_specific":{"indicators":{"package_integrity":[{"filename":"tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events-20.9.9.tgz","hashes":{"sha1":"5dc06b68889232c2203ea5f845fa558cab43ca17","sha512_sri":"sha512-hRFdyqvOLYS8tW6PRIgwJQ9NXs2aXpD9ezIosBTlW4IBeMM2HWQKsyDvPyni32Fah7fYlOVzhoX3Oj7ByKgjig=="}}],"evidence_files":[{"tlsh":"79a1779611a630298bb0dbe487179415f65bf663738086c4fb9ca5981f7712883b1efc","path":"_bootstrap.js","sha256":"46beaf2f025ff17901f29af3706d0e5f73ebdaaa9f1fd7e16829217a47232f17"},{"sha256":"9ebe1ca279ba7689a7f0eba8c9bd6bfcb20267bf738857704d17e19318725515","tlsh":"f9d0a7428655962319f85ad55ca25003b7b21f9f7039ed0a36b7382805684b6119f335","path":"package.json"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events/MAL-2026-12271.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}