Loading npm security reports…

tinkoff-statist-browser-typed-client-eventea.projects.finhealthwe | LPM Firewall

registry / Remote code execution / tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks

tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks

Finhealthwebmicroblocks abstraction layer

This report shows the evidence for tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks@20.4.7. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The reachable import-time loader provides a concrete arbitrary remote code execution chain, not legitimate telemetry behavior. Lack of an npm lifecycle hook does not mitigate execution on normal package use.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of the package main entrypoint.

Impact

Arbitrary code from attacker-controlled remote infrastructure executes with the importing process's privileges.

Mechanism

remote payload download, temporary-file drop, chmod, and detached shell execution

Attack narrative

Loading index.js silently requires _vendor.js. Its init routine fetches a platform-specific binary from obfuscated remote hosts, with DNS TXT payload fallback, writes it to a temporary location, makes it executable on Unix, and starts it detached through a shell or cmd.exe. The payload is neither authenticated nor inspected before execution.

AI rationale

The reachable import-time loader provides a concrete arbitrary remote code execution chain, not legitimate telemetry behavior. Lack of an npm lifecycle hook does not mitigate execution on normal package use.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf99-9b3.workers.dev

Source & flagged code

4 flagged · loading source

_vendor.jsView file

5const fs = require("fs"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L44: const EXPIRE_SEC = 21453; L45: const _l = (...a) => process.stderr.write(""); L46: ... L55: const isWin = _p("platform") === "win32"; L56: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L57: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L89: try { L90: require("dns").resolveTxt(d, (e, rr) => { L91: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_vendor.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _vendor.js L5: const fs = require("fs"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L44: const EXPIRE_SEC = 21453; L45: const _l = (...a) => process.stderr.write(""); L46: ... L55: const isWin = _p("platform") === "win32"; L56: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L57: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L89: try { L90: require("dns").resolveTxt(d, (e, rr) => { L91: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_vendor.jsView on unpkg · L5

116try { L117: const cp = require("child_process"); L118: if (isWin) {

High

Child Process

Package source references child process execution.

_vendor.jsView on unpkg · L116

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = fb-cards-form-no-resident-information@20.4.4 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:20.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged

_vendor.jsView file

5const fs = require("fs"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L44: const EXPIRE_SEC = 21453; L45: const _l = (...a) => process.stderr.write(""); L46: ... L55: const isWin = _p("platform") === "win32"; L56: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L57: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L89: try { L90: require("dns").resolveTxt(d, (e, rr) => { L91: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_vendor.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _vendor.js L5: const fs = require("fs"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L44: const EXPIRE_SEC = 21453; L45: const _l = (...a) => process.stderr.write(""); L46: ... L55: const isWin = _p("platform") === "win32"; L56: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L57: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L89: try { L90: require("dns").resolveTxt(d, (e, rr) => { L91: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_vendor.jsView on unpkg · L5

116try { L117: const cp = require("child_process"); L118: if (isWin) {

High

Child Process

Package source references child process execution.

_vendor.jsView on unpkg · L116

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = fb-cards-form-no-resident-information@20.4.4 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:20.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg