MAL-2026-12253

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-art.apps.reporegistry/MAL-2026-12253.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12253
Published
2026-08-05T09:02:22Z
Modified
2026-08-05T10:06:45.539980513Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1)

On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev) with DNS-TXT fallback to tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The destination hostnames and the childprocess module name are assembled at runtime via array.join to evade static inspection. The fetched bytes are written to /var/tmp/.cache<rand> on Unix or %TEMP%\dotnetdiag_<rand>.exe on Windows, chmod'd to 0755, and detach-spawned via /bin/sh -c or cmd /c start. A second module, lib/telemetry.js, contains the same dropper pattern (base64 chunk assembly, string-concatenated fs.chmodSync, cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true})) as a staged/redundant payload. Package naming and the analytics-SDK framing do not match the observed behavior, which is a runtime fetch-and-execute of attacker-controlled bytes on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:02:22Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014519",
            "import_time": "2026-08-05T09:28:21.548317614Z",
            "sha256": "d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1",
            "versions": [
                "20.9.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-art.apps.reporegistry

Package

Name
tinkoff-statist-browser-typed-client-art.apps.reporegistry
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-art.apps.reporegistry

Affected ranges

Affected versions

20.*
20.9.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "tinkoff-statist-browser-typed-client-art.apps.reporegistry-20.9.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-zg6p2lJMWCMFBkkQVEpn4cfVR9vBj8rf/OjONgW96+nHBEoctdb1eT3XuqjCvZ9OasMDA61YyFumyQSjG0oi9g==",
                "sha1": "a84840f2ca7f770a2ebfb5cae5bdcafd0b2d9618"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "bab1b4aa066570194b70dbe5ca179415f65af6537380c194fbaca99c0fb212483f2efc",
            "sha256": "857e2279bfdce4a0861be162742e27a03370db701c215d13ada5676361cd4f9d",
            "path": "_adapter.js"
        },
        {
            "tlsh": "78835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "c6d7c3d30552c41875e964c02716939ed9a05588880f7b8e50febd11094d6686",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-art.apps.reporegistry/MAL-2026-12253.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]