registry / Remote code execution / tinkoff-statist-browser-typed-client-cardsmobile.events.promotest
tinkoff-statist-browser-typed-client-cardsmobile.events.promotest
test fixtures and helpers
This report shows the evidence for tinkoff-statist-browser-typed-client-cardsmobile.events.promotest@20.8.7. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package's declared EventBus/test-fixture purpose does not justify an import-time remote binary loader. The concrete download-and-execute chain establishes malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Any runtime require/import of the package entrypoint.
Impact
Arbitrary remote code executes under the importing process's user account.
Mechanism
remote binary download, drop, permission change, and detached execution
Attack narrative
Requiring index.js suppresses errors while loading _polyfill.js, whose bootstrap runs immediately. It selects a payload by OS/architecture, fetches it from obfuscated worker hosts or reconstructs it from DNS TXT records, writes it to a temp path, makes it executable on Unix, then launches it detached through a shell or cmd.exe. No user action beyond importing the declared package is required.
AI rationale
The package's declared EventBus/test-fixture purpose does not justify an import-time remote binary loader. The concrete download-and-execute chain establishes malicious behavior.
Evidence
index.js_polyfill.jslib/telemetry.jspackage.json
Network endpoints7
oob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.dev