Malicious code in tinkoff-boxy-desktop-features-banner (npm)
The npm package tinkoff-boxy-desktop-features-banner contained malicious code that downloads and executes platform-specific binary payloads from attacker-controlled infrastructure. The package used obfuscated Cloudflare Workers hostnames and DNS fallback resolution to retrieve and execute unsigned binaries without verification.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of tinkoff-boxy-desktop-features-banner
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-boxy-desktop-features-bannernpm package containing malicious code in index.js and lib/telemetry.js
The npm package tinkoff-boxy-desktop-features-banner was found to contain malicious code unrelated to its stated purpose as a features banner component. The package's main entry point (index.js) and a secondary module (lib/telemetry.js, disguised as an 'Analytics SDK') both contained dropper functionality.\n\nThe malicious code assembles obfuscated Cloudflare Workers hostnames through array-join concatenation (e.g., oob-worker.cf99-9b3.workers.dev, cf103-070/cf102-baf/cf101-adf.workers.dev) with DNS TXT record fallbacks resolving through tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The code downloads platform-specific binary payloads without hash or signature verification, writes them to temporary directories (/tmp on Unix, %TEMP% on Windows) under disguised filenames, sets executable permissions (0755), and spawns them detached via shell commands.\n\nThe second module uses obfuscation techniques such as string concatenation (require('child_' + 'process'), fs['chmod' + 'Sync']) to evade static analysis. The remote destinations and executed payloads are entirely unrelated to the package's advertised functionality.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-12048).
Indicators of compromise
- Packages
- tinkoff-boxy-desktop-features-banner
- Domains
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately remove tinkoff-boxy-desktop-features-banner from all projects and dependencies
- Audit npm package.json and lock files for any presence of this package
- Review and revoke any credentials or secrets that may have been exposed on systems where this package was installed
- Scan systems that installed this package for unexpected binaries in /tmp or %TEMP% directories and for suspicious process execution
- Update to a clean version if a legitimate replacement is available, or use an alternative package
- Monitor outbound network connections to the identified malicious domains (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) and Cloudflare Workers subdomains
Sources
- GitHub Advisory GHSA-v8mq-h2v3-675q · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-boxy-desktop-features-banner (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-boxy-desktop-features-banner-npm-7aqy83
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in typescirpt-core (npm)
The npm package 'typescirpt-core' (a typosquat of 'typescript') contained malicious code that executed on install, downloading and executing a Windows executable and pivoting WSL environments back to the host Windows system.
npmTyposquattingCompromised package - containedcritical
Malicious code in typescrit-cli (npm)
The npm package typescrit-cli contained malicious postinstall code that downloads and executes a payload, with capability to escape WSL containers and compromise Windows hosts. The package name is a typosquat of the legitimate typescript-cli.
npmTyposquattingCompromised package - containedcritical
Malicious code in typesript-cli (npm)
The npm package 'typesript-cli' (a one-character typosquat of 'typescript') contains malicious code in its postinstall script that downloads and executes a Windows PE binary, and can cross the Linux/WSL sandbox boundary to execute payloads on the Windows host. The script also beacons to a hardcoded IP endpoint.
npmTyposquattingCompromised package - containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package