🛡️ MAL-2026-12227 — tinkoff-boxy-atom-text-link

Malicious code in tinkoff-boxy-atom-text-link (npm)

Source: amazon-inspector

The package's index.js unconditionally requires./_loader on module load. _loader.js selects a platform-specific payload path and fetches bytes from one of three hardcoded Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site that reads a chunk count from c.<domain> and reassembles base64-encoded payload bytes from N.<domain> TXT records. The fetched bytes are written to a temp file with a decoy name (dotnet_diag_*.exe /.cache_*), chmod 0755 on POSIX, and spawned detached via /bin/sh -c "<file> &" or cmd.exe /c start. A /tmp/.analytics_state marker rate-limits re-execution. A secondary module lib/telemetry.js bundled in the tarball replicates the same drop-and-exec primitives (string-split require of child_process, bracket-property chmodSync, base64 buffer decode, cp.spawn("/bin/sh", ["-c", filePath + " &"])). The package is advertised as a text-link provider; the shipped code has no relation to that purpose.