Malicious code in tinkoff-cache-path (npm)

The npm package tinkoff-cache-path was found to contain malicious code that executes on package load. The package advertises itself as an in-memory cache utility, but its index.js unconditionally requires _compat.js, which acts as a dropper for remote code execution.

The _compat.js module selects a platform-specific endpoint from an obfuscated list of hosts assembled at runtime, including domains such as oob-worker.cf*.workers.dev and *.dl.well1.site. It downloads an opaque native binary over HTTPS, with a fallback to a DNS-TXT covert channel that queries records at c. and reassembles numbered base64 TXT chunks into an executable buffer.

The downloaded payload is written to /var/tmp or %TEMP% with disguised filenames (.cache_ on Unix, dotnet_diag_.exe on Windows), made executable via chmod +x, and spawned detached using cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() on Unix or spawn("cmd",...) on Windows. The package uses an analytics_state marker file and DO_NOT_TRACK-shaped environment variables as cover for its malicious activity.

The declared purpose of caching has no relationship to the actual functionality of fetching and executing native binaries from attacker-controlled infrastructure.