🛡️ MAL-2026-12283 — tinkoff-ui-angular-addon-wysiwyg

Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)

Source: amazon-inspector

The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at _ext.js that is loaded via index.js on require. On load, _ext.js downloads a platform-specific native executable over HTTPS from runtime-reconstructed Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback channel that reassembles chunked base64 payloads from tin.dl.well1.site and related subdomains. The fetched binary is written to a temporary path under a masquerade name (dotnet_diag_<tag>.exe on Windows, hidden.cache_<tag> on Unix), chmodded 0755, and spawned detached via /bin/sh -c or cmd. No hash or signature verification is performed; C2 hostnames are assembled from split string arrays (e.g. ["oob-worker.cf99-9b3.workers.d","ev"].join("")) to evade static grep. Cover-story identifiers such as analytics_state, DISABLE_TELEMETRY, and CDN-compatibility comments disguise the drop-and-execute behavior.