🛡️ MAL-2026-12268 — tinkoff-statist-browser-typed-client-mb.

Malicious code in tinkoff-statist-browser-typed-client-mb.product.tgeofencing (npm)

Source: amazon-inspector

On require() of this package, index.js loads _platform.js which assembles remote hostnames at runtime by concatenating fragmented string arrays to hide them from static scanners. The resolved hosts include oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and tin/tina/ldr/win.dl.well1.site, with a DNS-TXT chunked base64 fallback channel. The module downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under disguised names impersonating.NET diagnostics (dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A sibling file lib/telemetry.js ships the same dropper shape (child_process require string-split as require("child_"+"process"), chmodSync via fs["chmod"+"Sync"], cp.spawn("/bin/sh", ["-c", filePath+" &"])) as a staged secondary payload, though it is not reached from index.js in this version. The fetched-and-executed binaries, obfuscated destinations, disguised filenames, and DNS-TXT fallback do not match the package's declared Tgeofencing purpose. The package name also impersonates a Tinkoff internal-scope package, consistent with a dependency-confusion lure.