MAL-2026-16270

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tink/tink-link-core/MAL-2026-16270.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16270
Published
2026-09-17T23:13:32Z
Modified
2026-09-17T23:30:06Z
Summary
Malicious code in @tink/tink-link-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf)

The package impersonates the Tink open-banking SDK (name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage github.com/tink-link/core) but its actual behavior is host reconnaissance and DNS exfiltration. The package.json install script runs node index.js, and both the install entry and main entry load lib/core.js, which reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a prefix and a hardcoded domain as DNS labels, and issues a dns.resolve4() lookup. The destination hostname and module/API names are reconstructed at runtime from hex byte arrays via Buffer.from(...).toString('utf8') in lib/b02e30.js and lib/6ad264.js — the decoded domain is oob.algamil7x.xyz and the label prefix is tinkcore. Module names 'os','dns','process' and API names 'userInfo','hostname','cwd','resolve4' are loaded via module.constructor._load with hex-decoded strings to hide them from static review. DNS-based egress bypasses HTTP proxy and firewall controls. The beacon fires automatically on npm install (via the install lifecycle script) and again on require() of the package, giving the attacker installer username, hostname, and current working directory for every affected environment.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020141",
            "import_time": "2026-09-17T23:14:58.569775484Z",
            "modified_time": "2026-09-17T23:13:32Z",
            "sha256": "826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf",
            "source": "amazon-inspector",
            "versions": [
                "9.9.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @tink/tink-link-core

Package

Name
@tink/tink-link-core
View open source insights on deps.dev
Purl
pkg:npm/%40tink/tink-link-core

Affected ranges

Affected versions

9.*
9.9.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/core.js",
            "sha256": "d24415d02b2768deed6613ba41e3837825889459718a582d352a0805d40a321c",
            "tlsh": "d0f02d69b393c48f97e096d0360a53d18559c3c0e7cf8195fb7c4a87904e7d1ca85a55"
        },
        {
            "path": "lib/6ad264.js",
            "sha256": "bb8f934f09924e478a88d798ef00498007fb5e94f22f924b2f618c4e895a4ba6",
            "tlsh": "04f022ce6234b0cf4a8fb869e6459245a8ad52e0426491b57d7c42c61ba8b2921f3290"
        },
        {
            "path": "package.json",
            "sha256": "f889e10d0d366eebd0cf4ef9b161e1fd522f31c252ec3384f813c96e50bc30d7",
            "tlsh": "dc016f61572744275ec03a80ea6a6505f2724c164950bc199b97812886cd6b763ff32e"
        }
    ],
    "package_integrity": [
        {
            "filename": "tink-link-core-9.9.10.tgz",
            "hashes": {
                "sha1": "d199f7be7e631de1870237d5547e3b81122bd32a",
                "sha512_sri": "sha512-IYg3S2t1sgNpl5y2f/5T5Y3gG2Nuxp7l4cdSj+XOMVPPAI9oBbjIwHvOvp9PLKAGnC4P6IO9lGnwVbYiGKVbyw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tink/tink-link-core/MAL-2026-16270.json"