Malicious code in tinkoff-boxy-desktop-features-banner (npm)

The npm package tinkoff-boxy-desktop-features-banner was found to contain malicious code unrelated to its stated purpose as a features banner component. The package's main entry point (index.js) and a secondary module (lib/telemetry.js, disguised as an 'Analytics SDK') both contained dropper functionality.\n\nThe malicious code assembles obfuscated Cloudflare Workers hostnames through array-join concatenation (e.g., oob-worker.cf99-9b3.workers.dev, cf103-070/cf102-baf/cf101-adf.workers.dev) with DNS TXT record fallbacks resolving through tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The code downloads platform-specific binary payloads without hash or signature verification, writes them to temporary directories (/tmp on Unix, %TEMP% on Windows) under disguised filenames, sets executable permissions (0755), and spawns them detached via shell commands.\n\nThe second module uses obfuscation techniques such as string concatenation (require('child_' + 'process'), fs['chmod' + 'Sync']) to evade static analysis. The remote destinations and executed payloads are entirely unrelated to the package's advertised functionality.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-12048).