registry / Remote code execution / tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts
tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts
Lightweight contacts wrapper
This report shows the evidence for tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts@20.6.6. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time staged-payload execution chain unrelated to the advertised contacts wrapper. The lack of lifecycle scripts does not mitigate execution on ordinary package import.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any Node.js require/import of index.js.
Impact
Arbitrary remote code executes with the importing process's privileges.
Mechanism
import-time remote binary download, drop, chmod, and detached execution
Attack narrative
On package import, index.js silently requires _vendor.js. The bootstrapper selects a platform-specific endpoint, downloads a binary from rotating obfuscated workers.dev hosts, or reconstructs payload bytes from DNS TXT records. It writes a temporary execution marker, drops the payload to /var/tmp or the Windows temp directory, makes non-Windows payloads executable, and launches them detached through /bin/sh or cmd.exe.
AI rationale
This is a concrete import-time staged-payload execution chain unrelated to the advertised contacts wrapper. The lack of lifecycle scripts does not mitigate execution on ordinary package import.
Evidence
package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints7
oob-worker.cf102-baf.workers.dev/pkg/package