OpenSSF/OSV advisory MAL-2026-12264 confirms this npm version as malicious. Package main entry require()'s./_adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string array-join, downloads a platform-specific binary (with a DNS TXT base64 reassembly fallback that enumerates c.<domain> for a count and then 0.<domain>..N.<domain> for chunked payload parts), writes it to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)
Details
Package main entry require()'s./_adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string array-join, downloads a platform-specific binary (with a DNS TXT base64 reassembly fallback that enumerates c.<domain> for a count and then 0.<domain>..N.<domain> for chunked payload parts), writes it to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. A second dropper in lib/telemetry.js repeats the pattern under an 'Analytics SDK' cover story, using require('child_'+'process'), fs['chmod'+'Sync'], base64 chunk assembly, and cp.spawn('/bin/sh',['-c', filePath+' &'],{detached:true}). Destinations and API surfaces are constructed at runtime via string-splitting to evade static scanners. No binding.gyp, no publisher-owned host, no version pinning, no hash verification, and the cover-story naming (dotnet_diag, extension, Analytics SDK) does not match any documented package purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events@20.9.9 as malicious (MAL-2026-12264): Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)