tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common
This report shows the evidence for tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common@20.8.7. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-12270 confirms this npm version as malicious.
Advisory
MAL-2026-12270
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm)
Details
On require/import, index.js loads _bridge.js which selects a platform-specific endpoint and downloads an opaque executable over HTTPS from hardcoded hosts assembled via string-join obfuscation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked base64 fallback via *.dl.well1.site. The downloaded bytes are written to disguised paths (/var/tmp/.cache_<hex> on Unix, %TEMP%\dotnet_diag_<hex>.exe on Windows), chmod'd 0o755, and spawned detached via /bin/sh -c or cmd /c start /b. Hostnames are reconstructed from character-fragment arrays via.join(), staging filenames masquerade as system diagnostics/cache artifacts, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env checks are used as cover. The package name presents as a scoped Tinkoff internal client but the shipped code performs full remote code execution on the installer's host at load time.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.