OpenSSF/OSV advisory MAL-2026-12283 confirms this npm version as malicious. The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at _ext.js that is loaded via index.js on require. On load, _ext.js downloads a platform-specific native executable over HTTPS from runtime-reconstructed Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)
Details
The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at _ext.js that is loaded via index.js on require. On load, _ext.js downloads a platform-specific native executable over HTTPS from runtime-reconstructed Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback channel that reassembles chunked base64 payloads from tin.dl.well1.site and related subdomains. The fetched binary is written to a temporary path under a masquerade name (dotnet_diag_<tag>.exe on Windows, hidden.cache_<tag> on Unix), chmodded 0755, and spawned detached via /bin/sh -c or cmd. No hash or signature verification is performed; C2 hostnames are assembled from split string arrays (e.g. ["oob-worker.cf99-9b3.workers.d","ev"].join("")) to evade static grep. Cover-story identifiers such as analytics_state, DISABLE_TELEMETRY, and CDN-compatibility comments disguise the drop-and-execute behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms tinkoff-ui-angular-addon-wysiwyg@20.7.8 as malicious (MAL-2026-12283): Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)