MAL-2026-12235

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-boxy-mobile-separator/MAL-2026-12235.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12235
Published
2026-08-05T08:57:33Z
Modified
2026-08-05T10:06:37.292697719Z
Summary
Malicious code in tinkoff-boxy-mobile-separator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490)

On require() of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments (e.g. ['oob-worker.cf101-adf.worker','s.','de','v'].join('')), downloads a platform-specific opaque binary via https.get, writes it to /var/tmp or %TEMP% under a randomized hidden name (dotnetdiag_*), chmods it 0755, and spawns it detached via spawn('/bin/sh',['-c',fp+' &']) or spawn('cmd',...). A DNS-TXT covert channel (c.<domain> for chunk count, N.<domain> for base64-encoded chunks reassembled with Buffer.from(parts.join(''),'base64')) provides a fallback payload retrieval mechanism. No hash or signature verification is performed on the fetched executable. A second, structurally identical dropper is bundled at lib/telemetry.js (not reached from the main require graph but present in the tarball). The package name impersonates the Tinkoff namespace; there is no legitimate SDK behavior in the shipped code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T08:57:33Z",
            "source": "amazon-inspector",
            "sha256": "38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490",
            "import_time": "2026-08-05T09:28:17.792297801Z",
            "id": "IN-MAL-2026-014487",
            "versions": [
                "20.8.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-boxy-mobile-separator

Package

Name
tinkoff-boxy-mobile-separator
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-boxy-mobile-separator

Affected ranges

Affected versions

20.*
20.8.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "tinkoff-boxy-mobile-separator-20.8.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-4mF6jtfgCY3uVkynGaFgnzdEi+8T89gxgiiS6EWEB8+ilaR8Ztpcnp8/b8CDmFw4yUz2be3bacAr3zW00LIMIw==",
                "sha1": "9575175780417546423dfeedabf56da18fb8b37e"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "18b1a796016570188bb0e7e4c71b981af65bf6533780c680fbaca5945fb752483b2efc",
            "sha256": "3ab098bcc55453ef088bc0d2dfbd3d374cc24168c16076193929a6542aaf54bd",
            "path": "_init.js"
        },
        {
            "tlsh": "66835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "3c93503dff4ca39a7c970bcdce265581ea10b6a954ae403ffff702f48be32869",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-boxy-mobile-separator/MAL-2026-12235.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]