registry / Remote code execution / tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics
tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics
instrumentation SDK
This report shows the evidence for tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics@20.2.7. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete import-time staged-payload execution chain, not telemetry behavior. The lack of lifecycle hooks does not mitigate runtime remote code execution on import.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Runtime require/import of index.js.
Impact
Arbitrary remote code execution under the importing application's user account.
Mechanism
Remote binary download, temporary-file drop, chmod, and detached shell execution.
Attack narrative
A normal import loads _vendor.js. Its bootstrap selects an OS-specific endpoint, downloads an opaque payload from rotating hosts or reconstructs it from DNS TXT records, writes it into a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. No integrity verification or user action is required.
AI rationale
This is a concrete import-time staged-payload execution chain, not telemetry behavior. The lack of lifecycle hooks does not mitigate runtime remote code execution on import.
Evidence
package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf101-adf.workers.dev