🛡️ MAL-2026-12250 — tinkoff-pfp-integration-mobile-slider-ic

Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

Source: amazon-inspector

On require() of the package, index.js loads _init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare Workers hosts whose names are reassembled from split string fragments (oob-worker.cf103-070.workers.dev, cf99-9b3, cf100-416), with a DNS TXT-chunked base64 fallback via *.dl.well1.site domains (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). The downloaded payload is written to a temp path under a decoy name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> under /var/tmp on POSIX), chmod 0755'd via string-concatenated method name (fs['chmod'+'Sync']), and spawned detached via /bin/sh -c... & or cmd.exe /c start /b. The tarball also ships lib/telemetry.js (~81KB) containing a parallel dropper stage with the same primitives (base64 payload decoding, chmod 755, cp.spawn('/bin/sh',['-c',...])) wrapped in a fake analytics-SDK cover. Environment variables such as DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are honored as a cover story to evade sandboxes and CI. The package name resembles a Tinkoff internal scope but the shipped code has no legitimate mobile-slider-icons functionality.