🛡️ MAL-2026-12234 — tinkoff-boxy-mobile-documents

Malicious code in tinkoff-boxy-mobile-documents (npm)

Source: amazon-inspector

On require of the package, index.js loads./_platform.js, which selects a per-platform payload path, fetches an unsigned binary over HTTPS from string-split Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev) assembled via array joins, with a DNS TXT covert-channel fallback under *.dl.well1.site (also string-split). The fetched bytes are written to /tmp or %TEMP% under decoy names (analytics_state, dotnet_diag_*,.cache_*), chmodded to 0755, and spawned detached via /bin/sh -c or cmd /c start. Hostnames and resolver domains are obfuscated by array joins and child_process is referenced as require('child_' + 'process'), and the loader is framed with 'analytics/telemetry' comments and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT opt-out gates as cover. lib/telemetry.js contains a duplicate dropper implementation (base64 chunk assembly, cp.spawn('/bin/sh', ['-c', filePath + ' &']), chmod 0755 via computed property) bundled as an alternate loader. The package name impersonates a Tinkoff-branded mobile-documents component.