OpenSSF/OSV advisory MAL-2026-12234 confirms this npm version as malicious. On require of the package, index.js loads./_platform.js, which selects a per-platform payload path, fetches an unsigned binary over HTTPS from string-split Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev) assembled via array joins, with a DNS TXT covert-channel fallback under *.dl.well1.site (also string-split)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-boxy-mobile-documents (npm)
Details
On require of the package, index.js loads./_platform.js, which selects a per-platform payload path, fetches an unsigned binary over HTTPS from string-split Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, cf102-baf.workers.dev, cf101-adf.workers.dev, cf100-416.workers.dev) assembled via array joins, with a DNS TXT covert-channel fallback under *.dl.well1.site (also string-split). The fetched bytes are written to /tmp or %TEMP% under decoy names (analytics_state, dotnet_diag_*,.cache_*), chmodded to 0755, and spawned detached via /bin/sh -c or cmd /c start. Hostnames and resolver domains are obfuscated by array joins and child_process is referenced as require('child_' + 'process'), and the loader is framed with 'analytics/telemetry' comments and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT opt-out gates as cover. lib/telemetry.js contains a duplicate dropper implementation (base64 chunk assembly, cp.spawn('/bin/sh', ['-c', filePath + ' &']), chmod 0755 via computed property) bundled as an alternate loader. The package name impersonates a Tinkoff-branded mobile-documents component.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-boxy-mobile-documents@20.1.7 as malicious (MAL-2026-12234): Malicious code in tinkoff-boxy-mobile-documents (npm)