MAL-2026-12246

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-pfp-atom-styles-tiles/MAL-2026-12246.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12246
Published
2026-08-05T08:52:45Z
Modified
2026-08-05T10:06:42.421982682Z
Summary
Malicious code in tinkoff-pfp-atom-styles-tiles (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35)

index.js unconditionally require()s./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnames by concatenating string fragments (e.g. ["oob-worker.cf100-416",".wor","kers.d","ev"].join("")), downloads a native binary via https.get, and falls back to a DNS-TXT covert channel over *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) that fetches a chunk count and base64-decodes concatenated TXT records into an executable buffer. The payload is written to /tmp or %TEMP% under deceptive names (.cache<hex> on POSIX, dotnetdiag<hex>.exe on Windows), chmod 0755, and detached via spawn("/bin/sh", ["-c", filePath+" &"]) or cmd.exe/start. A second, larger dropper variant is shipped as lib/telemetry.js (~81KB) using the same obfuscation pattern (require("child"+"process"), fs["chmod"+"Sync"], base64-decoded buffer, detached spawn) framed as an "Analytics SDK" with a DISABLE_TELEMETRY cover story and a bogus "SHA-256 integrity check" comment that performs no integrity check. Any environment that require()s this package auto-executes attacker-controlled native code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35",
            "source": "amazon-inspector",
            "versions": [
                "20.2.8"
            ],
            "import_time": "2026-08-05T09:28:12.812899006Z",
            "modified_time": "2026-08-05T08:52:45Z",
            "id": "IN-MAL-2026-014453"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-pfp-atom-styles-tiles

Package

Name
tinkoff-pfp-atom-styles-tiles
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-pfp-atom-styles-tiles

Affected ranges

Affected versions

20.*
20.2.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "6dfbf91125ef04e8f76ebcfd2298e924f698b089",
                "sha512_sri": "sha512-IVK/hJ5titqZRF/mzibY22JIy3ESPHiiwjn0pdX05Y52hIXmukTvOXd1ykYC2jPAN4QWYsjtTxO955wi6iEC7g=="
            },
            "filename": "tinkoff-pfp-atom-styles-tiles-20.2.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "ac38ba20726291dcc3fbd51d894cea053226571448529d8062b2d9fd3b7c8d55",
            "tlsh": "a0f0fc8615debc6a8670bae6de630083f621c4754b4741547ec850fe0ea442812d9f7a"
        },
        {
            "path": "_ext.js",
            "sha256": "e0a29e30c4a8a3298d8fd754b1e768ceabf278a50e7ce1a143a281c7044ee690",
            "tlsh": "10a1b956166971184bb09be4c7178416f55bf66333808184fb9ca5986fb612482b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "57c1dbec216792bcaf76122a226b288aba780ef575ea899709b3742df7abc943",
            "tlsh": "6d835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-pfp-atom-styles-tiles/MAL-2026-12246.json"