MAL-2026-12254

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica/MAL-2026-12254.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12254
Published
2026-08-05T08:59:23Z
Modified
2026-08-05T10:06:46.385126130Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (801b453825e385d0c0c659b2037a6f8fcbcdfa0c0ae519ae103280639cd8ed99)

Package name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./init on load; init.js selects a platform-specific endpoint whose hostnames are reconstructed at runtime by joining string fragments (e.g. ["oob-wo","rker.cf103-070.","workers.de","v"].join("") and ['tin.dl.well1.','site'].join("")), fetches an opaque binary over HTTPS from anonymous *.workers.dev hosts, writes it to a temp path under a cover name (.cache<hex> / dotnetdiag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe start /b. When HTTPS fetches fail, a DNS-TXT covert channel queries c.<domain> for a chunk count, iterates n.<domain> TXT records under *.dl.well1.site, base64-concatenates the parts, and feeds the reconstructed buffer through the same write/chmod/spawn path. lib/telemetry.js mirrors the same write/chmod/spawn primitives. The destinations are not the declared publisher, no hash or signature is verified, and the hostname obfuscation and cover-naming serve only to evade static inspection.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T08:59:23Z",
            "source": "amazon-inspector",
            "sha256": "801b453825e385d0c0c659b2037a6f8fcbcdfa0c0ae519ae103280639cd8ed99",
            "import_time": "2026-08-05T09:28:19.003946255Z",
            "id": "IN-MAL-2026-014498",
            "versions": [
                "20.4.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica

Package

Name
tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica

Affected ranges

Affected versions

20.*
20.4.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica-20.4.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-UulcaPYQ5bZwKNVqLD+a8qQ0f75sNwwOSSttmk7FgZ8Og99hAc35SEBLzO3DwutrXJ24cCvaKpTHYMoMB1wcBg==",
                "sha1": "b5affabb7951e646460e1f1c0254beb5883b61d9"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d1b1c79a126a311c4bb097e587175815f55af66337808290fa9c9ac41fb7034c3b1efc",
            "sha256": "b9beb7ec49dd0327cca544664b6f8dadb1e1daf2632ad71bbb8ae890c3108c12",
            "path": "_init.js"
        },
        {
            "tlsh": "ded0a75706219cb309f652504ce2d562f3a31f1fa02adc0e75775518429037b04af334",
            "sha256": "72888e1c42e345f87e8c54517299c40c83b63673a46e2d8ca3ec094ae3e51ca3",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica/MAL-2026-12254.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]