registry / Remote code execution / tinkoff-statist-browser-typed-client-mb.reliability.android.events
tinkoff-statist-browser-typed-client-mb.reliability.android.events
pub/sub adapter
This report shows the evidence for tinkoff-statist-browser-typed-client-mb.reliability.android.events@20.5.4. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time staged payload chain with arbitrary binary execution, unrelated to the advertised pub/sub adapter. The absence of npm lifecycle hooks does not mitigate the reachable import-time behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Any require/import of the package main entrypoint.
Impact
Unconsented arbitrary native code execution under the importing process user.
Mechanism
remote payload download, drop, chmod, and detached execution
Attack narrative
The main entrypoint loads _loader.js during normal import. The loader fetches a platform-specific binary from obfuscated worker hosts, or reconstructs one from DNS TXT records, drops it into temp storage, marks it executable on Unix, and starts it detached via shell or cmd.exe.
AI rationale
This is a concrete import-time staged payload chain with arbitrary binary execution, unrelated to the advertised pub/sub adapter. The absence of npm lifecycle hooks does not mitigate the reachable import-time behavior.
Evidence
package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints6
oob-worker.cf99-9b3.workers.dev