MAL-2026-12257

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-dss.insurance.service/MAL-2026-12257.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12257
Published
2026-08-05T08:56:11Z
Modified
2026-08-05T10:06:47.976497541Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab)

On require of the package, index.js loads runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback to tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes the payload to /tmp with a hidden dot-prefixed filename (or to the Windows temp directory as dotnetdiag<rand>.exe), chmods it to 0755, and detached-spawns it via /bin/sh -c or cmd. Destination hostnames and API names are reassembled from split string arrays (e.g. ["oob-worker.cf102-ba","f.work","ers.d","ev"].join(""), require("child" + "process")) to evade static analysis. The tarball also ships lib/telemetry.js, an 81 KB secondary loader framed as a metrics SDK that contains the same drop-chmod-spawn primitives with base64-decoded chunks; it is not on the currently reachable import graph but duplicates the dropper capability. The package name impersonates a Tinkoff internal SDK; the anonymous Cloudflare Workers infrastructure and covert DNS fallback do not correspond to any first-party backend for the claimed purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "20.3.2"
            ],
            "import_time": "2026-08-05T09:28:16.567881818Z",
            "sha256": "06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab",
            "modified_time": "2026-08-05T08:56:11Z",
            "id": "IN-MAL-2026-014477",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-dss.insurance.service

Package

Name
tinkoff-statist-browser-typed-client-dss.insurance.service
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-dss.insurance.service

Affected ranges

Affected versions

20.*
20.3.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-z9iC4Zmic4O5H7T5SrsWbQAZFqcmWYDbk48LS0Es1hwgsSl8KrESGSXnNiKmrovbJBaK+D7eo2yW8QHi0R8WnQ==",
                "sha1": "4ed714d51a66af2e6d7571f8dd06e456b6a29e9e"
            },
            "filename": "tinkoff-statist-browser-typed-client-dss.insurance.service-20.3.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_runtime.js",
            "sha256": "3d8e905010247a43a54b18008270e61477bc83ece51214e2faaf8a1c4d21f03a",
            "tlsh": "98a1756a12aa71198bb0d7e487179419f65ae6633380c2d4fb9ca5885f7312483b2dfc"
        },
        {
            "sha256": "82fe669b740699cf69ee3c623d5fb29a7fa3c8e012270e425cbf353526f7c834",
            "path": "lib/telemetry.js",
            "tlsh": "6d835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-dss.insurance.service/MAL-2026-12257.json"