MAL-2026-12271 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

The package is presented as a trivial event emitter but its main entry (index.js) auto-loads bootstrap.js on require(). bootstrap.js selects a per-platform payload URL, downloads a native binary over HTTPS from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64 fallback via tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site, writes the binary to /tmp or %TEMP% under cover-story filenames (.cache<hex>, dotnet_diag<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe. C2 hostnames are reconstructed at runtime by.join() on split fragments to hide them from string search, and execution is gated behind a /tmp marker TTL plus opt-out-shaped env vars (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) as cover. Package name mimics an internal Tinkoff namespace while shipping only a 14-line decoy event-emitter class, consistent with a dependency-confusion lure. Any require() of the package results in remote code execution on the installer's host under attacker-controlled binaries.