MAL-2026-12276

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events/MAL-2026-12276.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12276
Published
2026-08-05T09:01:07Z
Modified
2026-08-05T10:06:56.674905262Z
Summary
Malicious code in tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e)

Package presents itself as a trivial event bus (index.js exports a small EventBus class) but its main entry unconditionally requires./ext on load. ext.js selects a platform-specific payload, downloads a binary from Cloudflare Workers hosts whose names are reassembled at runtime from split-string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT fallback under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site that base64-decodes chunked TXT records into a binary. The downloaded bytes are written to /tmp or %TEMP% under masqueraded names (dotnetdiag<rand>.exe,.cache_<rand>), chmod 0755 on Unix, and spawned detached via cmd.exe or /bin/sh. Host strings and DNS discovery domains are concatenated from fragmented arrays to evade static analysis, and a no-op _l() function is scattered around the network I/O. The package name mimics an internal Tinkoff typed-client naming convention, consistent with a dependency-confusion attack against a private scope.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014510",
            "import_time": "2026-08-05T09:28:20.676736035Z",
            "sha256": "574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e",
            "modified_time": "2026-08-05T09:01:07Z",
            "versions": [
                "20.6.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events

Package

Name
tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events

Affected ranges

Affected versions

20.*
20.6.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-NC/DoPphD5viYc2VRP7r1unsccLk4ABOSh8uB6HyqpHkwCrd+k00vOEHD1GgXa618z8uH5QChBqD5EQp14yIWQ==",
                "sha1": "b58360cf4bf968fbc07ecd622f621dcbb96da0e6"
            },
            "filename": "tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events-20.6.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "5accae449fd8251fbcac637c631779366332b65439046f5699af20ab54e9c935",
            "path": "_ext.js",
            "tlsh": "fca1a79a256a301d4bb0e7e1c61b4415f65af2533780c294f75ca5985fb313482b2efc"
        },
        {
            "sha256": "6832d1029adbfd88835ce980d44e5ac540bbf0976c2782f1e8ffb1eef54e06b4",
            "path": "package.json",
            "tlsh": "84d0a9220201607718fc866449614403b3b20f6f3038ac0a22bb2c2844500b6049f331"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events/MAL-2026-12276.json"