registry / Remote code execution / tinkoff-statist-browser-typed-client-eventea.projects.smartcam
tinkoff-statist-browser-typed-client-eventea.projects.smartcam
Cross-service smartcam adapter
This report shows the evidence for tinkoff-statist-browser-typed-client-eventea.projects.smartcam@20.6.3. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time staged payload loader and remote code execution chain, not ordinary telemetry. The unused telemetry module contains a parallel configurable loader design, reinforcing intent.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Requiring/importing the package entrypoint.
Impact
Arbitrary code execution under the importing user's privileges.
Mechanism
remote payload download, disk drop, and detached shell execution
Attack narrative
The entrypoint suppresses errors while importing _loader.js. That loader fetches a platform-specific binary from rotating obfuscated hosts, or reconstructs one from DNS TXT records, saves it under a disguised temporary filename, marks it executable on Unix, then starts it detached via /bin/sh or cmd.exe. The unverified payload is remote-controlled.
AI rationale
This is a concrete import-time staged payload loader and remote code execution chain, not ordinary telemetry. The unused telemetry module contains a parallel configurable loader design, reinforcing intent.
Evidence
package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf99-9b3.workers.dev/pkg/package