registry / tinkoff-mutual-mgm-form / 20.2.9

tinkoff-mutual-mgm-form@20.2.9

Internal tinkoff mutual mgm form module for platform services

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package automatically initiates a remote binary retrieval and execution chain. It uses obfuscated worker hosts, with DNS TXT delivery as a fallback.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary native code execution under the importing process's user account.

Mechanism

download, drop, chmod, and detached execution of an unverified remote payload

Attack narrative

The public entrypoint silently loads _compat.js. On import, it fetches a platform-specific executable from obfuscated remote hosts, falling back to DNS TXT chunks, writes it into a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The code suppresses errors and does not verify payload authenticity.

Rationale

This is a concrete import-time staged-payload execution chain, not telemetry: it retrieves and runs an unverified native binary without user action. The absence of lifecycle hooks does not mitigate execution caused by normal module import.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require('tinkoff-mutual-mgm-form'), index.js loads _compat.js, which selects a platform-specific asset path and fetches a native binary over HTTPS from Cloudflare Workers subdomains assembled via array.join('') string concatenation (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT chunked fallback to look-alike hosts under dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site). The fetched bytes are written to a masquerading path in /var/tmp or %TEMP% (e.g., dotnet_diag_<rnd>.exe or.cache_<rnd>), chmodded to 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe start /b. The require('child_process') module name is also split-string obfuscated, and cover-story comments frame the behavior as 'telemetry' and 'session tracking'. A second copy of the same fetch-write-chmod-spawn dropper is bundled in lib/telemetry.js as an 'Analytics SDK', staged as an alternate payload. Destinations, obfuscation, masquerading filenames, and detached execution are inconsistent with the package's declared purpose.

tinkoff-mutual-mgm-form@20.2.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code