OpenSSF/OSV advisory MAL-2026-12230 confirms this npm version as malicious. On require of this package, index.js loads _vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), downloads a platform-specific binary via https.get, and falls back to a covert channel that reconstructs a base64 payload from numbered DNS TXT records under...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)
Details
On require of this package, index.js loads _vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), downloads a platform-specific binary via https.get, and falls back to a covert channel that reconstructs a base64 payload from numbered DNS TXT records under tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site. The retrieved bytes are written to /tmp or %TEMP% under decoy names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and spawned detached via spawn('/bin/sh', ['-c', <path>+' &']) or cmd.exe /c start /b. A second module lib/telemetry.js, framed as an analytics SDK, ships the same base64-decode / chmodSync 0755 / detached spawn chain. The destinations are anonymous Cloudflare Workers subdomains and an unrelated DDNS-style domain; the fetched content is opaque native code executed on the installer's host with no verification.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-boxy-desktop-two-panel-right-image@20.4.8 as malicious (MAL-2026-12230): Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)