OpenSSF/OSV advisory MAL-2026-12050 confirms this npm version as malicious. On require() of the package, index.js loads _vendor.js which selects a platform-specific endpoint and fetches a binary payload from one of four Cloudflare Workers hosts whose names are assembled at runtime via string split/join concatenation (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS TXT-record fallback discovery...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)
Details
On require() of the package, index.js loads _vendor.js which selects a platform-specific endpoint and fetches a binary payload from one of four Cloudflare Workers hosts whose names are assembled at runtime via string split/join concatenation (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS TXT-record fallback discovery via tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to a randomized temp path with disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755 on POSIX, and executed detached via spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",...) on Windows. Hostnames and sensitive API names (child_process, chmodSync) are reconstructed from array joins to defeat static matching; a 22822-second cooldown flag suppresses re-execution. The package name imitates an internal Tinkoff scope while lib/telemetry.js is unused cover-story code. Installing or requiring this package executes attacker-controlled native code on the host.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-statist-browser-typed-client-sme.reporting.reporting@20.5.4 as malicious (MAL-2026-12050): Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)