OpenSSF/OSV advisory MAL-2026-12248 confirms this npm version as malicious. On require() of index.js, the package silently loads _bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT base64 fallback via subdomains of dl.well1.site) and downloads an unsigned platform-specific binary over HTTPS. The binary is written to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)
Details
On require() of index.js, the package silently loads _bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT base64 fallback via subdomains of dl.well1.site) and downloads an unsigned platform-specific binary over HTTPS. The binary is written to /var/tmp/.cache_<rand> on Unix or %TEMP%/dotnet_diag_<rand>.exe on Windows (a masquerade as a.NET diagnostic tool), chmod 0755, and detached-spawned via /bin/sh -c or cmd /c start. Re-execution is throttled by a state file (/tmp/.analytics_state or %TEMP%/analytics_state) checked against a MAX_AGE window. The package name impersonates Tinkoff internal tooling; the only functional code beyond a stub API surface is the dropper. Host reconstruction via array joins and the DNS-TXT payload transport are anti-analysis evasion.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-pfp-block-mobile-advert-footer@20.3.3 as malicious (MAL-2026-12248): Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)