🛡️ MAL-2026-12258 — tinkoff-statist-browser-typed-client-dwh

Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm)

Source: amazon-inspector

Requiring this package triggers _support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare workers.dev mirror hosts (assembled at runtime via.join('')) with a DNS-TXT chunked-base64 fallback channel on *.dl.well1.site, write the bytes to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmod 0755, and detach-spawn the binary via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed from split fragments; dropped filenames impersonate a dotnet diagnostic tool or hidden cache; module comments and environment variables named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK frame the code as analytics/telemetry as a cover story. The package name impersonates a Tinkoff-internal scope. Fetching and executing attacker-controlled bytes from non-publisher hosts at require time yields arbitrary code execution on the installer's host.