🛡️ MAL-2026-12246 — tinkoff-pfp-atom-styles-tiles

Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

Source: amazon-inspector

index.js unconditionally require()s./_ext inside a swallowed try/catch. _ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnames by concatenating string fragments (e.g. ["oob-worker.cf100-416",".wor","kers.d","ev"].join("")), downloads a native binary via https.get, and falls back to a DNS-TXT covert channel over *.dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) that fetches a chunk count and base64-decodes concatenated TXT records into an executable buffer. The payload is written to /tmp or %TEMP% under deceptive names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755, and detached via spawn("/bin/sh", ["-c", filePath+" &"]) or cmd.exe/start. A second, larger dropper variant is shipped as lib/telemetry.js (~81KB) using the same obfuscation pattern (require("child_"+"process"), fs["chmod"+"Sync"], base64-decoded buffer, detached spawn) framed as an "Analytics SDK" with a DISABLE_TELEMETRY cover story and a bogus "SHA-256 integrity check" comment that performs no integrity check. Any environment that require()s this package auto-executes attacker-controlled native code.