🛡️ MAL-2026-12273 — tinkoff-statist-browser-typed-client-sme

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm)

Source: amazon-inspector

The package typosquats an internal Tinkoff scope name. On require(), index.js loads _init.js, which builds attacker hostnames at runtime from string-fragment arrays joined via.join("") (e.g., ["oob-wor","ker.cf100","-416.wor","kers",".dev"].join("")), downloads an opaque binary from one of four Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS TXT fallback via tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes it to /tmp or %TEMP% under names mimicking Microsoft diagnostics (dotnet_diag_<hex>.exe /.cache_<hex>), applies executable permissions via fs["chmod"+"Sync"], and spawns it detached via cp.spawn("/bin/sh", ["-c", filePath + " &"], {detached:true}) or cmd.exe. Dangerous APIs are split-string-obfuscated (require("child_"+"process"), os["host"+"name"]) to evade string scanners. lib/telemetry.js contains a redundant WorkerHost download-and-execute path with base64 payload decoding and the same spawn/chmod primitives. An opt-out env-var check (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) and a /tmp/.analytics_state stamp gate limit re-execution to roughly once per six hours, characteristic of dropper anti-analysis rather than legitimate telemetry. The declared "shared primitives" purpose is inconsistent with fetching and executing a native binary.