Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

The npm package tinkoff-boxy-mobile-vivid-heading was found to contain malicious code in its runtime.js module. Upon package require, the code selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) whose names are reconstructed at runtime via string-fragment concatenation.\n\nThe package implements a DNS-TXT fallback channel that enumerates TXT records on tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site, base64-decoding concatenated chunks into an executable buffer. The fetched bytes are written to /var/tmp as a hidden dotfile on POSIX systems (or to %TEMP% as dotnet_diag*.exe on Windows), made executable with chmod 0755, and spawned detached via /bin/sh -c or cmd.exe with stdio ignored.\n\nA second module lib/telemetry.js contains an equivalent write+chmod+spawn+base64 chain under an 'Analytics SDK' cover story, though it is not reached from the entrypoint in the analyzed version. The stated 'device integration' purpose has no legitimate need for reconstructing destination hostnames from split fragments, shipping a DNS-TXT chunked binary loader, or fetching and executing opaque native binaries on load.\n\nThe malicious package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-c49g-3j6g-ff99.", <parameter name="remediation">["Immediately uninstall tinkoff-boxy-mobile-vivid-heading from all projects and environments", "Audit npm package.lock or yarn.lock files to identify all installations of this package", "Review system logs and process execution history on any machines where this package was installed for signs of unauthorized binary execution", "Regenerate any credentials or secrets that may have been exposed on affected systems", "Update to a patched version if one is available, or replace the package with a legitimate alternative", "Implement npm package scanning and verification in your CI/CD pipeline to detect malicious packages before installation"]