MAL-2026-12272

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics/MAL-2026-12272.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12272
Published
2026-08-05T09:02:43Z
Modified
2026-08-05T10:06:54.599567077Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (189b38f890bbf70f19838f7da330c3bf2798028f8cdc600bc58b5e38419e7795)

On require of index.js the package loads vendor.js, which selects a platform-specific payload (linux/darwin/win32), downloads it over HTTPS from Cloudflare Workers hostnames assembled at runtime via string split-and-join (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback under *.dl.well1.site (e.g. tin.dl.well1.site). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<hex>, dotnetdiag<hex>.exe), chmodded 0755, and detach-spawned via /bin/sh -c or cmd.exe /c start. A second copy of the same fetch->write->chmod->spawn chain is bundled in lib/telemetry.js framed as an analytics SDK, using method-name string concatenation (fs["chmod"+"Sync"]) to hide the operation. The hostnames and DNS fallback domains are reconstructed from split fragments to evade string scanning. The package name mimics an internal Tinkoff scoped path but is published as a flat, unscoped npm identifier.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:02:43Z",
            "id": "IN-MAL-2026-014521",
            "import_time": "2026-08-05T09:28:21.72687336Z",
            "versions": [
                "20.2.7"
            ],
            "source": "amazon-inspector",
            "sha256": "189b38f890bbf70f19838f7da330c3bf2798028f8cdc600bc58b5e38419e7795"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics

Package

Name
tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics

Affected ranges

Affected versions

20.*
20.2.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics-20.2.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-a3gsaxYP+Q767JbgTZo9h3dulhIWt+7/BksEij5at/IGJPgdMH3dERdxqlewokRU31/UFr7TyQAD2EkRronrvg==",
                "sha1": "ed94029f64508425577476ed1437d135c98be39b"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "tlsh": "7aa1a79a16aa71094bb097e0c71b5815f55af26333c0c284f7ac69881f7212483b2efc",
            "sha256": "4951e97662f089838160eb51edff8cb7f904f967c0baa3fdf203750464473c64"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "ff835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "4c0186abacb3fb43fc0d67802e63fdebed305a744903f37dd41199176c0c842d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics/MAL-2026-12272.json"