MAL-2026-12252

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-pwa-confac-types/MAL-2026-12252.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12252
Published
2026-08-05T09:03:45Z
Modified
2026-08-05T10:06:45.250717990Z
Summary
Malicious code in tinkoff-pwa-confac-types (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fdebc9c281924002edabc3f53a796ac4a5a5e78d64fbb70974b2c3597de7f84d)

The package advertises itself as a types interface but its main entry silently requires adapter.js inside a try/catch. On require, adapter.js assembles obfuscated Cloudflare Workers hostnames by array-join (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked base64 fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site, downloads a platform-specific binary, writes it to /var/tmp (hidden dot-file name) or %TEMP% (disguised as dotnetdiag*.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. childprocess is required lazily inside the activation path and the dropper honors DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK as a cover story. No native source ships in the tarball and the behavior is unrelated to any 'types' functionality. An unreferenced 81 KB lib/telemetry.js is present as additional staging.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:03:45Z",
            "source": "amazon-inspector",
            "sha256": "fdebc9c281924002edabc3f53a796ac4a5a5e78d64fbb70974b2c3597de7f84d",
            "import_time": "2026-08-05T09:28:22.36592508Z",
            "id": "IN-MAL-2026-014528",
            "versions": [
                "20.7.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-pwa-confac-types

Package

Name
tinkoff-pwa-confac-types
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-pwa-confac-types

Affected ranges

Affected versions

20.*
20.7.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "tinkoff-pwa-confac-types-20.7.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-YsJZ0AlN8Rm/K8GQaT7Qc0LIhnk1LOowd51RTpPrOuSJOjq0eCDfRwrzvtgUuHuqqlQC+91s5Z856iohoW7qvQ==",
                "sha1": "27cfd9e7f4c740cd41a2c16d77033193adff2b3d"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "e9a1a99a12a5701c4bb0ebf4c61b5815f65af26337818294f79c65885f7352483b2efc",
            "sha256": "3eed0559d23827018b0df4b55ccdfd64256dd075b4cbc16b3b503bfacf4a4d79",
            "path": "_adapter.js"
        },
        {
            "tlsh": "caf081cb35deb4228370e2e3ce634051f6318d340b5781547acc40ee0fa441442d8fb9",
            "sha256": "252686aafd6d457c3170b80e2ee80f602202f4fba89eb54388f8822170786adc",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-pwa-confac-types/MAL-2026-12252.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]