MAL-2026-12250

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-pfp-integration-mobile-slider-icons/MAL-2026-12250.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12250
Published
2026-08-05T08:56:19Z
Modified
2026-08-05T10:06:44.225133335Z
Summary
Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a)

On require() of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare Workers hosts whose names are reassembled from split string fragments (oob-worker.cf103-070.workers.dev, cf99-9b3, cf100-416), with a DNS TXT-chunked base64 fallback via *.dl.well1.site domains (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). The downloaded payload is written to a temp path under a decoy name (dotnetdiag<hex>.exe on Windows,.cache<hex> under /var/tmp on POSIX), chmod 0755'd via string-concatenated method name (fs['chmod'+'Sync']), and spawned detached via /bin/sh -c... & or cmd.exe /c start /b. The tarball also ships lib/telemetry.js (~81KB) containing a parallel dropper stage with the same primitives (base64 payload decoding, chmod 755, cp.spawn('/bin/sh',['-c',...])) wrapped in a fake analytics-SDK cover. Environment variables such as DISABLETELEMETRY/ANALYTICSOPTOUT/DONOT_TRACK are honored as a cover story to evade sandboxes and CI. The package name resembles a Tinkoff internal scope but the shipped code has no legitimate mobile-slider-icons functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014478",
            "import_time": "2026-08-05T09:28:16.732422625Z",
            "sha256": "3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a",
            "modified_time": "2026-08-05T08:56:19Z",
            "versions": [
                "20.2.2"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-pfp-integration-mobile-slider-icons

Package

Name
tinkoff-pfp-integration-mobile-slider-icons
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-pfp-integration-mobile-slider-icons

Affected ranges

Affected versions

20.*
20.2.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-m9GG1rUmSkP0yCqXW8QwQSOWMuHNv7Hmwhyn6oUwW7nxcAtSY8OHYBhQMiLUzSGoaKF1ieR0sKmz2KF0xmYLdA==",
                "sha1": "b61d5fbfd3bda93fec8a133cc293e70e62a4c35a"
            },
            "filename": "tinkoff-pfp-integration-mobile-slider-icons-20.2.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_init.js",
            "sha256": "0ea65de1259d15cd55cfbaf76dd6871dadb7291ba3f92e41fce0118e094caa1b",
            "tlsh": "2ca1b95a1666701d8bb0ebe4c71b8826f657f66337808291f79c95844fb352483b1efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "744a25c988460d2b3bef1d60b4e9c9152435d50e917afa556ede690df8018e34",
            "tlsh": "e4835055566a202186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-pfp-integration-mobile-slider-icons/MAL-2026-12250.json"