MAL-2026-12243

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-fb-service-prefill-profile-contact/MAL-2026-12243.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12243
Published
2026-08-05T09:03:21Z
Modified
2026-08-05T10:06:40.980142415Z
Summary
Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f)

On require of the package's main entry, vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under oob-worker.cfNNN-XXX.workers.dev (host strings assembled via split-and-join fragments to evade static analysis) and, on failure, reassembles a base64-encoded payload from sequential DNS TXT record lookups against subdomains of *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site). The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache<hex>, dotnetdiag<hex>.exe,.analytics_state), chmod 0755, then spawned detached via spawn('/bin/sh', ['-c', '<fp> &']) on Unix or spawn('cmd', ['/c','start','/b',...]) on Windows. There is no version pinning, no hash or signature verification, and comments frame the behavior as 'telemetry/analytics' unrelated to the package's advertised Tinkoff SDK prefill purpose. The DNS-TXT reassembly path is a covert delivery channel designed to bypass HTTPS egress filtering.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f",
            "versions": [
                "20.2.3"
            ],
            "import_time": "2026-08-05T09:28:22.105403192Z",
            "modified_time": "2026-08-05T09:03:21Z",
            "id": "IN-MAL-2026-014525"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-fb-service-prefill-profile-contact

Package

Name
tinkoff-fb-service-prefill-profile-contact
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-fb-service-prefill-profile-contact

Affected ranges

Affected versions

20.*
20.2.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "9ef273aed898092565b1eee2b9bd6b7f05dfced3",
                "sha512_sri": "sha512-Rbdi9nFNfQuX/BKetLBy9Cc7BTJZopXix9trc7S5iS9aJhyfSgQP8j+/ILoxQnjvYRwIRpj8nlFIO+qnujq8oA=="
            },
            "filename": "tinkoff-fb-service-prefill-profile-contact-20.2.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "7d1109492f7f2a8996ec4792cbc45b0d942481d58cfd75236608f3c63ef3c1f4",
            "tlsh": "9ab1a65606aa30188bf0dbe4cb17541af65be66333808294fb5ca9981f7312483b2dfc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-fb-service-prefill-profile-contact/MAL-2026-12243.json"