🛡️ MAL-2026-12257 — tinkoff-statist-browser-typed-client-dss

Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)

Source: amazon-inspector

On require of the package, index.js loads _runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback to tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes the payload to /tmp with a hidden dot-prefixed filename (or to the Windows temp directory as dotnet_diag_<rand>.exe), chmods it to 0755, and detached-spawns it via /bin/sh -c or cmd. Destination hostnames and API names are reassembled from split string arrays (e.g. ["oob-worker.cf102-ba","f.work","ers.d","ev"].join(""), require("child_" + "process")) to evade static analysis. The tarball also ships lib/telemetry.js, an 81 KB secondary loader framed as a metrics SDK that contains the same drop-chmod-spawn primitives with base64-decoded chunks; it is not on the currently reachable import graph but duplicates the dropper capability. The package name impersonates a Tinkoff internal SDK; the anonymous Cloudflare Workers infrastructure and covert DNS fallback do not correspond to any first-party backend for the claimed purpose.