MAL-2026-12272 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)

On require of index.js the package loads vendor.js, which selects a platform-specific payload (linux/darwin/win32), downloads it over HTTPS from Cloudflare Workers hostnames assembled at runtime via string split-and-join (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback under *.dl.well1.site (e.g. tin.dl.well1.site). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe), chmodded 0755, and detach-spawned via /bin/sh -c or cmd.exe /c start. A second copy of the same fetch->write->chmod->spawn chain is bundled in lib/telemetry.js framed as an analytics SDK, using method-name string concatenation (fs["chmod"+"Sync"]) to hide the operation. The hostnames and DNS fallback domains are reconstructed from split fragments to evade string scanning. The package name mimics an internal Tinkoff scoped path but is published as a flat, unscoped npm identifier.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.