registry / tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics / 20.2.7

tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics@20.2.7

instrumentation SDK

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous bootstrap that retrieves and executes an unverified native payload. It leaves a temporary stamp to limit repeat execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime require/import of index.js.

Impact

Arbitrary remote code execution under the importing application's user account.

Mechanism

Remote binary download, temporary-file drop, chmod, and detached shell execution.

Attack narrative

A normal import loads _vendor.js. Its bootstrap selects an OS-specific endpoint, downloads an opaque payload from rotating hosts or reconstructs it from DNS TXT records, writes it into a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. No integrity verification or user action is required.

Rationale

This is a concrete import-time staged-payload execution chain, not telemetry behavior. The lack of lifecycle hooks does not mitigate runtime remote code execution on import.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev

On require of index.js the package loads _vendor.js, which selects a platform-specific payload (linux/darwin/win32), downloads it over HTTPS from Cloudflare Workers hostnames assembled at runtime via string split-and-join (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback under *.dl.well1.site (e.g. tin.dl.well1.site). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmodded 0755, and detach-spawned via /bin/sh -c or cmd.exe /c start. A second copy of the same fetch->write->chmod->spawn chain is bundled in lib/telemetry.js framed as an analytics SDK, using method-name string concatenation (fs["chmod"+"Sync"]) to hide the operation. The hostnames and DNS fallback domains are reconstructed from split fragments to evade string scanning. The package name mimics an internal Tinkoff scoped path but is published as a flat, unscoped npm identifier.

tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics@20.2.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code