MAL-2026-12266

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-leasing.admin.events/MAL-2026-12266.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12266
Published
2026-08-05T09:03:52Z
Modified
2026-08-05T10:06:51.877335631Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-leasing.admin.events (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3c5bfe643ac3fad66a9484db8ea78c195b19f385df1c68e39b4d4181f329f7d4)

The package's main entry index.js require()s helpers.js, whose top-level bootstrap runs on load. It detects platform and architecture, fetches a native binary from one of several string-split-obfuscated hosts under *.workers.dev (with a DNS-TXT base64 fallback via *.well1.site subdomains), writes the payload to a disguised path such as /var/tmp/.cache<hex> or %TEMP%/dotnetdiag<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and the child_process require target are assembled from array.join fragments to evade string scanning, and a stamp-file check skips re-execution on subsequent installs. A second parallel dropper implementation is bundled as lib/telemetry.js (~81KB) using the same transport, DNS failover, chmod 755, and /bin/sh -c spawn pattern. The package name is a typosquat of an internal Tinkoff namespace with no legitimate purpose visible in the tarball.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:03:52Z",
            "id": "IN-MAL-2026-014529",
            "import_time": "2026-08-05T09:28:22.467915257Z",
            "versions": [
                "20.7.7"
            ],
            "source": "amazon-inspector",
            "sha256": "3c5bfe643ac3fad66a9484db8ea78c195b19f385df1c68e39b4d4181f329f7d4"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-leasing.admin.events

Package

Name
tinkoff-statist-browser-typed-client-leasing.admin.events
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-leasing.admin.events

Affected ranges

Affected versions

20.*
20.7.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "tinkoff-statist-browser-typed-client-leasing.admin.events-20.7.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-4fbeXow2iRhxwxQhe3NySwAypFXhXJmjm6XA5pZxjvTm97G21ljxKiXq2Sh2h1l/nxBcF+FBu8J6JxcOyCh2MQ==",
                "sha1": "a230cdda5fd8adce6a7c46fe9e5562b0cc438a32"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_helpers.js",
            "tlsh": "c1a1846a02a6301987b0ebe4cb175416f657f26373809294f79ca5885ff212482f3efc",
            "sha256": "9ca28d11dad866b601c2e2dd6e821dd3ad0a3bb11d16b513f5d653e7b7a552cb"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "eb835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "82ee3e2cd5bf0cacdfbbec15dac1ff69eade029b35f1cc97d58ead4bc19d7e08"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-leasing.admin.events/MAL-2026-12266.json"