registry / Remote code execution / tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web
tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web
Web runtime support module
This report shows the evidence for tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web@20.3.8. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package's only advertised runtime API does not require telemetry, yet its entrypoint silently fetches and executes unverified remote bytes. This is a concrete import-time remote-code-execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime require/import of index.js
Impact
Arbitrary remote code executes with the importing process's permissions.
Mechanism
import-time remote binary download and detached execution
Attack narrative
At module import, index.js requires _bridge.js. Its run() function obtains a platform-specific binary over HTTPS from hard-coded workers.dev hosts, or reconstructs one from DNS TXT records, saves it under a disguised temporary filename, makes it executable on Unix, and launches it through a detached shell or cmd.exe process.
AI rationale
The package's only advertised runtime API does not require telemetry, yet its entrypoint silently fetches and executes unverified remote bytes. This is a concrete import-time remote-code-execution chain.
Evidence
package.jsonindex.js_bridge.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>
Network endpoints7
oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/package