registry / Remote code execution / tinkoff-statist-browser-typed-client-test.softwarecenter.metrics
tinkoff-statist-browser-typed-client-test.softwarecenter.metrics
observability bridge
This report shows the evidence for tinkoff-statist-browser-typed-client-test.softwarecenter.metrics@20.1.3. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete, automatic remote payload execution chain unrelated to the documented metrics API. Absence of an install hook does not mitigate import-time execution.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Any Node.js require/import of index.js, including normal application startup.
Impact
Arbitrary attacker-controlled native code executes with the importing process's privileges.
Mechanism
Remote binary download and detached execution with DNS-TXT fallback.
Attack narrative
Normal import loads setup.js. Unless opt-out variables are set or a short-lived stamp exists, it retrieves a platform-specific blob from hard-coded HTTPS mirrors or encoded DNS TXT records, saves it under a disguised temporary filename, marks it executable on Unix, and launches it through a detached shell or cmd.exe. The large telemetry module duplicates this payload-loader behavior behind a purported native-profiler feature.
AI rationale
This is a concrete, automatic remote payload execution chain unrelated to the documented metrics API. Absence of an install hook does not mitigate import-time execution.
Evidence
index.jssetup.jslib/telemetry.jspackage.jsonREADME.md/var/tmp/.cache_<random>C:\Windows\Temp\dotnet_diag_<random>.exe
Network endpoints7
oob-worker.cf100-416.workers.dev