MAL-2026-12254 Malicious code in tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica (npm)

Package name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./init on load; init.js selects a platform-specific endpoint whose hostnames are reconstructed at runtime by joining string fragments (e.g. ["oob-wo","rker.cf103-070.","workers.de","v"].join("") and ['tin.dl.well1.','site'].join("")), fetches an opaque binary over HTTPS from anonymous *.workers.dev hosts, writes it to a temp path under a cover name (.cache<hex> / dotnet_diag<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe start /b. When HTTPS fetches fail, a DNS-TXT covert channel queries c.<domain> for a chunk count, iterates n.<domain> TXT records under *.dl.well1.site, base64-concatenates the parts, and feeds the reconstructed buffer through the same write/chmod/spawn path. lib/telemetry.js mirrors the same write/chmod/spawn primitives. The destinations are not the declared publisher, no hash or signature is verified, and the hostname obfuscation and cover-naming serve only to evade static inspection.