🛡️ MAL-2026-12262 — tinkoff-statist-browser-typed-client-inv

Malicious code in tinkoff-statist-browser-typed-client-investing.product.pulse (npm)

Source: amazon-inspector

The package's main entrypoint (index.js) unconditionally requires _bootstrap.js, which downloads a platform-specific executable from a rotating list of Cloudflare Workers subdomains (oob-worker.cf10{0,1,3}-*.workers.dev) with a DNS TXT fallback resolved via *.dl.well1.site, writes it to a disguised path (.cache_<rnd>, dotnet_diag_<rnd>.exe), chmods it to 755, and spawns it detached via /bin/sh or cmd. Destination hostnames are reconstructed at runtime from split string arrays (e.g. ['oob-worker.','cf10','2-baf.','workers','.dev'].join('')) and API names are assembled dynamically (fs['chmod'+'Sync']) to evade static inspection. No hash or signature verification of the fetched binary is performed, and the fetched host is unrelated to any publisher domain. A second parallel dropper is bundled in lib/telemetry.js (base64 payload assembly + cp.spawn('/bin/sh', ['-c', filePath+' &']) + fs['chmod'+'Sync'] to 0755) shipped in the tarball. The package name impersonates a Tinkoff internal scope with no plausible legitimate purpose matching the observed behavior.