OpenSSF/OSV advisory MAL-2026-12256 confirms this npm version as malicious. On require() of the package, index.js loads _loader.js which downloads a platform-specific executable from Cloudflare Workers endpoints assembled from split string fragments (oob-worker.cf103-070.workers.dev and related tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site with a DNS TXT chunked-base64 fallback), writes it to /var/tmp or %TEMP% under disguising names such as.cache_<hex> and...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci (npm)
Details
On require() of the package, index.js loads _loader.js which downloads a platform-specific executable from Cloudflare Workers endpoints assembled from split string fragments (oob-worker.cf103-070.workers.dev and related tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site with a DNS TXT chunked-base64 fallback), writes it to /var/tmp or %TEMP% under disguising names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods 0755 on Unix, and spawns it detached via cmd.exe or /bin/sh. Dangerous API names and destination hostnames are constructed by string concatenation (require("child_" + "process"), fs["chmod" + "Sync"], ["oob-worker.","cf10",...].join("")) to evade static analysis. A stamp file at /tmp/.analytics_state gates re-execution to roughly once per ~20000s, and env vars DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK provide a cover-story opt-out. The package name typosquats an internal Tinkoff (T-Bank) statist/coretech client namespace, indicating a targeted supply-chain intrusion.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci@20.1.2 as malicious (MAL-2026-12256): Malicious code in tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci (npm)