Malicious code in tinkoff-cache-path (npm)
The npm package tinkoff-cache-path contained malicious code that downloads and executes a platform-specific native binary from attacker-controlled infrastructure upon package load. The package masqueraded as an in-memory cache utility but instead acted as a dropper for remote code execution.
- Disclosed
- Last updated
- Blast radius
- All users of tinkoff-cache-path npm package
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-cache-pathnpm package
The npm package tinkoff-cache-path was found to contain malicious code that executes on package load. The package advertises itself as an in-memory cache utility, but its index.js unconditionally requires _compat.js, which acts as a dropper for remote code execution.
The _compat.js module selects a platform-specific endpoint from an obfuscated list of hosts assembled at runtime, including domains such as oob-worker.cf*.workers.dev and *.dl.well1.site. It downloads an opaque native binary over HTTPS, with a fallback to a DNS-TXT covert channel that queries records at c. and reassembles numbered base64 TXT chunks into an executable buffer.
The downloaded payload is written to /var/tmp or %TEMP% with disguised filenames (.cache_ on Unix, dotnet_diag_.exe on Windows), made executable via chmod +x, and spawned detached using cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() on Unix or spawn("cmd",...) on Windows. The package uses an analytics_state marker file and DO_NOT_TRACK-shaped environment variables as cover for its malicious activity.
The declared purpose of caching has no relationship to the actual functionality of fetching and executing native binaries from attacker-controlled infrastructure.
Indicators of compromise
- Packages
- tinkoff-cache-path
- Domains
- oob-worker.cf*.workers.dev
- *.dl.well1.site
- c.
Remediation
- Immediately uninstall tinkoff-cache-path from all systems
- Audit npm package.json and lock files for any presence of tinkoff-cache-path
- Review system logs and process execution history for suspicious activity from /var/tmp or %TEMP% directories
- Check for unexpected network connections to oob-worker.cf*.workers.dev, *.dl.well1.site, or DNS queries to c.
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm dependencies and use npm audit to identify any other compromised packages
Sources
- GitHub Advisory GHSA-9gcw-36vr-jw5g · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-cache-path (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-cache-path-npm-179358
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in anthropic-setup
The npm package anthropic-setup contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in async-mutex-v2
Malware was discovered in the npm package async-mutex-v2. Systems with this package installed are considered fully compromised and require immediate remediation including credential rotation and package removal.
npmCompromised package - containedcritical
Malware in leb128x
The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - activecritical
Malware in banana-stand
The npm package banana-stand contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package