registry / tinkoff-terminal-kit-carousel / 20.6.3

tinkoff-terminal-kit-carousel@20.6.3

Internal tinkoff terminal kit carousel module for platform services

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Ordinary require/import silently fetches a platform-specific remote payload, stores it in a temporary directory, and executes it detached. It also falls back to DNS-delivered base64 payloads.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Importing or requiring the package entrypoint.

Impact

Unconsented arbitrary native code execution in the importing user's environment.

Mechanism

Remote binary download, temporary-file drop, permission change, and detached execution.

Attack narrative

Requiring index.js catches and suppresses errors from requiring _adapter.js, whose top-level run() executes immediately. It checks a short cooldown marker, fetches a platform-specific binary from obfuscated remote hosts or reconstructs one through DNS TXT records, writes it to a temporary filename, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The unrelated-looking telemetry implementation contains a similar configurable downloader/executor pattern but is not required by the entrypoint.

Rationale

This is a concrete, automatic remote-payload execution chain unrelated to the declared carousel functionality. It is malicious despite having no npm lifecycle script.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_state

Network endpoints7

On require() of the package, index.js loads _adapter.js, which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), writes the bytes to /tmp or %TEMP% under a hidden/decoy filename (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmods 0755, and spawns it detached via `/bin/sh` or `cmd.exe`. Hostnames are assembled at runtime from split string arrays joined together to evade static analysis, and a cooldown marker file (`.analytics_state`) suppresses re-execution. If the HTTPS fetch fails, `loadViaDns` retrieves base64-encoded chunks from TXT records under `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, and `win.dl.well1.site`, reassembles them into a binary, and executes it via the same path. No source is shipped for the executed payload, no hash or signature is verified, and no user consent is obtained. The package name resembles the Tinkoff Investments brand but the code has no relation to any documented Tinkoff SDK.

tinkoff-terminal-kit-carousel@20.6.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code