OpenSSF/OSV advisory MAL-2026-12238 confirms this npm version as malicious. The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require(), index.js loads _shim.js, which selects a platform-specific payload path, downloads a binary over HTTPS from hardcoded, string-split Cloudflare Workers subdomains (oob-worker.cf1030-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-component-limits (npm)
Details
The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require(), index.js loads _shim.js, which selects a platform-specific payload path, downloads a binary over HTTPS from hardcoded, string-split Cloudflare Workers subdomains (oob-worker.cf1030-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmod 0755'd, and spawned detached via /bin/sh -c or cmd. Hostnames are assembled from split fragments at runtime to evade string scanning.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-component-limits@20.4.9 as malicious (MAL-2026-12238): Malicious code in tinkoff-component-limits (npm)