MAL-2026-12267 Malicious code in tinkoff-statist-browser-typed-client-mb.product.restrictions.arrestments (npm)

On require() of the package's main index.js, loader.js selects a platform-specific endpoint and fetches an opaque native binary over HTTPS from a rotating list of *.workers.dev hosts whose hostnames are assembled at runtime via string-split concatenation (e.g. ["oob-worker.cf1","01-adf.workers",".d","ev"].join("")). The fetched bytes are written to /var/tmp/.cache<hex> or %TEMP%\dotnet_diag_<hex>.exe (a filename mimicking.NET diagnostics), chmod'd 0755, and spawned detached/unref'd via /bin/sh -c or cmd.exe /c start /b. If HTTPS fails, the loader falls back to DNS TXT queries against c.<domain> and numbered chunks under *.dl.well1.site zones (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), concatenates and base64-decodes the TXT records, and executes the resulting binary through the same write+chmod+spawn path. The file uses variable names such as analytics_state, telemetry, and a DISABLE_TELEMETRY env var, and lib/telemetry.js is a sibling with an equivalent chunked base64 write+chmod+spawn pathway. The package presents itself as an "arrestments provider" for an internal typed client and has no legitimate reason to fetch and execute anonymous binaries. No pinning, no hash verification, no publisher-controlled destination.