{"id":"MAL-2026-16270","summary":"Malicious code in @tink/tink-link-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf)\nThe package impersonates the Tink open-banking SDK (name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage github.com/tink-link/core) but its actual behavior is host reconnaissance and DNS exfiltration. The package.json install script runs `node index.js`, and both the install entry and main entry load lib/core.js, which reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a prefix and a hardcoded domain as DNS labels, and issues a dns.resolve4() lookup. The destination hostname and module/API names are reconstructed at runtime from hex byte arrays via Buffer.from(...).toString('utf8') in lib/b02e30.js and lib/6ad264.js — the decoded domain is oob.algamil7x.xyz and the label prefix is tinkcore. Module names 'os','dns','process' and API names 'userInfo','hostname','cwd','resolve4' are loaded via module.constructor._load with hex-decoded strings to hide them from static review. DNS-based egress bypasses HTTP proxy and firewall controls. The beacon fires automatically on `npm install` (via the install lifecycle script) and again on `require()` of the package, giving the attacker installer username, hostname, and current working directory for every affected environment.\n","modified":"2026-09-17T23:30:06.461736705Z","published":"2026-09-17T23:13:32Z","database_specific":{"malicious-packages-origins":[{"sha256":"826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf","source":"amazon-inspector","versions":["9.9.10"],"id":"IN-MAL-2026-020141","import_time":"2026-09-17T23:14:58.569775484Z","modified_time":"2026-09-17T23:13:32Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@tink/tink-link-core/v/9.9.10"}],"affected":[{"package":{"name":"@tink/tink-link-core","ecosystem":"npm","purl":"pkg:npm/%40tink/tink-link-core"},"versions":["9.9.10"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"tink-link-core-9.9.10.tgz","hashes":{"sha1":"d199f7be7e631de1870237d5547e3b81122bd32a","sha512_sri":"sha512-IYg3S2t1sgNpl5y2f/5T5Y3gG2Nuxp7l4cdSj+XOMVPPAI9oBbjIwHvOvp9PLKAGnC4P6IO9lGnwVbYiGKVbyw=="}}],"evidence_files":[{"tlsh":"d0f02d69b393c48f97e096d0360a53d18559c3c0e7cf8195fb7c4a87904e7d1ca85a55","path":"lib/core.js","sha256":"d24415d02b2768deed6613ba41e3837825889459718a582d352a0805d40a321c"},{"sha256":"bb8f934f09924e478a88d798ef00498007fb5e94f22f924b2f618c4e895a4ba6","tlsh":"04f022ce6234b0cf4a8fb869e6459245a8ad52e0426491b57d7c42c61ba8b2921f3290","path":"lib/6ad264.js"},{"path":"package.json","sha256":"f889e10d0d366eebd0cf4ef9b161e1fd522f31c252ec3384f813c96e50bc30d7","tlsh":"dc016f61572744275ec03a80ea6a6505f2724c164950bc199b97812886cd6b763ff32e"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tink/tink-link-core/MAL-2026-16270.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}