MAL-2026-12260

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-eventea.projects.smartcam/MAL-2026-12260.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12260
Published
2026-08-05T09:00:28Z
Modified
2026-08-05T10:06:49.232206778Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.smartcam (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (edf869ab3e355848cb77fff3b129c2fe0b80e01286fe28783a0e66e064cee87e)

On require() of the package, index.js loads loader.js which downloads a platform-specific native binary from Cloudflare workers.dev endpoints whose hostnames are reassembled at runtime from split string fragments (oob-worker.cf99-9b3.workers.dev, cf103-070.workers.dev, cf102-baf.workers.dev, cf101-adf.workers.dev), with a DNS TXT-record base64 fallback across tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd. A cache marker file named analyticsstate /.analyticsstate is used to gate re-execution. No hash or signature verification is performed on the downloaded binary. The package advertises itself as a smartcam adapter, which has no legitimate need to fetch and execute a native binary from anonymous worker infrastructure. A second, unreferenced module lib/telemetry.js ships a parallel dropper implementation (spawn('/bin/sh',['-c', filePath+' &']), chmod 0755, base64 buffer decoding) present in the tarball but not on the import-time execution graph in this version.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "edf869ab3e355848cb77fff3b129c2fe0b80e01286fe28783a0e66e064cee87e",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T09:00:28Z",
            "versions": [
                "20.6.3"
            ],
            "import_time": "2026-08-05T09:28:19.823412453Z",
            "id": "IN-MAL-2026-014505"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-eventea.projects.smartcam

Package

Name
tinkoff-statist-browser-typed-client-eventea.projects.smartcam
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-eventea.projects.smartcam

Affected ranges

Affected versions

20.*
20.6.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "495170c80956d1c644e5e7b029fd46d20b3a3faf",
                "sha512_sri": "sha512-ngfR3IWVE1D/6a5xIdgtB0s4yBnEWeaFUxIO+2wVy1JsK/E/g89VUg9lNTB2KdPXEL57lMHkPQFs91srDwh7Nw=="
            },
            "filename": "tinkoff-statist-browser-typed-client-eventea.projects.smartcam-20.6.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_loader.js",
            "sha256": "36f7dd5bbf4bcf9d35595d98778aa15f923b69ff84f8f5fbf6f77d7216ea4760",
            "tlsh": "4ca1a6aa126630198bb0ebe48b175415f65af6633380c2d4fb5c65881fb316483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "d395b73d89caee1db7505e1992d9d6b3516291e8169c60cf892b74118ee1cf80",
            "tlsh": "89835056566a502186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-eventea.projects.smartcam/MAL-2026-12260.json"