MAL-2026-12271

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events/MAL-2026-12271.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12271
Published
2026-08-05T08:58:02Z
Modified
2026-08-05T10:06:54Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4)

The package is presented as a trivial event emitter but its main entry (index.js) auto-loads bootstrap.js on require(). bootstrap.js selects a per-platform payload URL, downloads a native binary over HTTPS from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64 fallback via tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes the binary to /tmp or %TEMP% under cover-story filenames (.cache, dotnet_diag.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe. C2 hostnames are reconstructed at runtime by.join() on split fragments to hide them from string search, and execution is gated behind a /tmp marker TTL plus opt-out-shaped env vars (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) as cover. Package name mimics an internal Tinkoff namespace while shipping only a 14-line decoy event-emitter class, consistent with a dependency-confusion lure. Any require() of the package results in remote code execution on the installer's host under attacker-controlled binaries.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014490",
            "import_time": "2026-08-05T09:28:18.078963548Z",
            "modified_time": "2026-08-05T08:58:02Z",
            "sha256": "48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4",
            "source": "amazon-inspector",
            "versions": [
                "20.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events

Package

Name
tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events

Affected ranges

Affected versions

20.*
20.9.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "sha256": "46beaf2f025ff17901f29af3706d0e5f73ebdaaa9f1fd7e16829217a47232f17",
            "tlsh": "79a1779611a630298bb0dbe487179415f65bf663738086c4fb9ca5981f7712883b1efc"
        },
        {
            "path": "package.json",
            "sha256": "9ebe1ca279ba7689a7f0eba8c9bd6bfcb20267bf738857704d17e19318725515",
            "tlsh": "f9d0a7428655962319f85ad55ca25003b7b21f9f7039ed0a36b7382805684b6119f335"
        }
    ],
    "package_integrity": [
        {
            "filename": "tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events-20.9.9.tgz",
            "hashes": {
                "sha1": "5dc06b68889232c2203ea5f845fa558cab43ca17",
                "sha512_sri": "sha512-hRFdyqvOLYS8tW6PRIgwJQ9NXs2aXpD9ezIosBTlW4IBeMM2HWQKsyDvPyni32Fah7fYlOVzhoX3Oj7ByKgjig=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events/MAL-2026-12271.json"