MAL-2026-12249 Malicious code in tinkoff-pfp-block-mobile-panels (npm)

On require() of the package, helpers.js selects a platform-specific binary path, downloads bytes from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS-based fallback via subdomains of well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), writes the payload to /tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Host names and dangerous API names (child_process, chmodSync) are assembled at runtime from split strings via.join('') to evade static analysis. index.js unconditionally require('./_helpers'), so the dropper fires on any import of the package. A second dropper variant with the same shape ships in lib/telemetry.js (~81KB, currently unreferenced from index.js). Package name impersonates the Tinkoff brand and README references an 'internal tracker' to suggest insider legitimacy, consistent with a dependency-confusion lure targeting Tinkoff-adjacent developer workstations.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.