🛡️ MAL-2026-12272 — tinkoff-statist-browser-typed-client-sme

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)

Source: amazon-inspector

On require of index.js the package loads _vendor.js, which selects a platform-specific payload (linux/darwin/win32), downloads it over HTTPS from Cloudflare Workers hostnames assembled at runtime via string split-and-join (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback under *.dl.well1.site (e.g. tin.dl.well1.site). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmodded 0755, and detach-spawned via /bin/sh -c or cmd.exe /c start. A second copy of the same fetch->write->chmod->spawn chain is bundled in lib/telemetry.js framed as an analytics SDK, using method-name string concatenation (fs["chmod"+"Sync"]) to hide the operation. The hostnames and DNS fallback domains are reconstructed from split fragments to evade string scanning. The package name mimics an internal Tinkoff scoped path but is published as a flat, unscoped npm identifier.