registry / Remote code execution / tinkoff-statist-browser-typed-client-sme.rko.authorization.common
tinkoff-statist-browser-typed-client-sme.rko.authorization.common
shared primitives
This report shows the evidence for tinkoff-statist-browser-typed-client-sme.rko.authorization.common@20.5.5. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains concrete import-time download-and-execute behavior, not merely telemetry primitives. The lack of install hooks does not mitigate execution when a consumer imports the advertised main entrypoint.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime import/require of the package main entrypoint.
Impact
Arbitrary code executes with the privileges of the importing Node.js process.
Mechanism
import-time staged remote payload execution
Attack narrative
Requiring index.js silently imports _init.js. Its start routine selects an OS-specific endpoint, downloads an opaque payload over HTTPS or reconstructs it from DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. The downloaded bytes are neither authenticated nor validated beyond length.
AI rationale
The package contains concrete import-time download-and-execute behavior, not merely telemetry primitives. The lack of install hooks does not mitigate execution when a consumer imports the advertised main entrypoint.
Evidence
package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints8
oob-worker.cf101-adf.workers.dev