MAL-2026-12283

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-ui-angular-addon-wysiwyg/MAL-2026-12283.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12283
Published
2026-08-05T08:58:43Z
Modified
2026-08-05T10:06:59.292644271Z
Summary
Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520)

The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at ext.js that is loaded via index.js on require. On load, ext.js downloads a platform-specific native executable over HTTPS from runtime-reconstructed Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback channel that reassembles chunked base64 payloads from tin.dl.well1.site and related subdomains. The fetched binary is written to a temporary path under a masquerade name (dotnetdiag<tag>.exe on Windows, hidden.cache<tag> on Unix), chmodded 0755, and spawned detached via /bin/sh -c or cmd. No hash or signature verification is performed; C2 hostnames are assembled from split string arrays (e.g. ["oob-worker.cf99-9b3.workers.d","ev"].join("")) to evade static grep. Cover-story identifiers such as analyticsstate, DISABLE_TELEMETRY, and CDN-compatibility comments disguise the drop-and-execute behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "20.7.8"
            ],
            "id": "IN-MAL-2026-014494",
            "import_time": "2026-08-05T09:28:18.497067235Z",
            "modified_time": "2026-08-05T08:58:43Z",
            "source": "amazon-inspector",
            "sha256": "78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520"
        }
    ]
}
References
Credits

Affected packages

npm / tinkoff-ui-angular-addon-wysiwyg

Package

Name
tinkoff-ui-angular-addon-wysiwyg
View open source insights on deps.dev
Purl
pkg:npm/tinkoff-ui-angular-addon-wysiwyg

Affected ranges

Affected versions

20.*
20.7.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "tinkoff-ui-angular-addon-wysiwyg-20.7.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-q/1wNkg/fhiK8oTwL2HMjUzBOWObgo0uNBchNfT+FBrvDMJdg9ZhpvvqJJVOkP52VYO181Ogzkn/Z1kSlKMEzA==",
                "sha1": "74805b66313c8058d61d35fe4feb8b5a8103a0b5"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_ext.js",
            "tlsh": "9ba1c795166a70188bb0abf4c6175415f65be2933780c2c4f79c99981fb712483b1efc",
            "sha256": "bd2e8358fdaf532ebf1d1833fe1c451ee96511246a4a219d8a882b31a9483486"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tinkoff-ui-angular-addon-wysiwyg/MAL-2026-12283.json"