Malicious code in tinkoff-component-infopanel (npm)
The npm package tinkoff-component-infopanel contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers hosts upon installation. The package impersonates the Tinkoff brand and executes the dropper via top-level require() in index.js, compromising any system that installs it as a dependency.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed tinkoff-component-infopanel as a dependency
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-component-infopanelnpm package impersonating Tinkoff brand
The npm package tinkoff-component-infopanel was found to contain malicious code designed to download and execute arbitrary native binaries. Upon require of the package, a _platform.js module downloads platform-specific executables from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with DNS-TXT fallback resolution via *.dl.well1.site.
The downloaded binaries are written to masqueraded cache paths using cover-story names such as dotnet_diag_, .cache_, and .analytics_state, then made executable (chmod 0o755) and spawned detached via /bin/sh -c or cmd. The destination hostnames are assembled at runtime by joining string fragments to evade static pattern matching.
The package impersonates the Tinkoff brand while declaring an empty author, no repository, and a README labeling it as an 'internal' module. Critically, the malicious dropper executes via top-level require() from index.js, meaning importing this package as a dependency automatically executes the fetched binary on the installer's host without any hash or signature verification.
The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-fprc-5vxr-hqwp.
Indicators of compromise
- Packages
- tinkoff-component-infopanel
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- *.dl.well1.site
Remediation
- Immediately remove tinkoff-component-infopanel from all package.json files and dependency trees
- Audit npm install logs and CI/CD logs for any installations of tinkoff-component-infopanel
- Inspect systems that installed this package for unexpected processes, network connections, or suspicious binaries in cache directories (.cache_, .analytics_state, dotnet_diag_)
- Regenerate any credentials, signing keys, or secrets that may have been exposed on affected systems
- Review outbound network connections to Cloudflare Workers hosts (oob-worker.cf*.workers.dev) and *.dl.well1.site
- Update npm lockfiles and re-run clean installs from trusted sources
- Monitor for supply chain indicators of compromise from systems that installed this package
Sources
- GitHub Advisory GHSA-fprc-5vxr-hqwp · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-component-infopanel (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-component-infopanel-npm-4299vt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in supersig (npm)
The supersig npm package contains malicious code in its published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source tree. The bundles execute a decrypt-and-execute chain at load time using a DES key from an unpinned mkb-manager dependency, allowing remote code execution on any consumer.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
npmAI agents & skillsMalicious commitCompromised package - resolvedcritical
Malicious code in stretchshop (npm)
The npm package stretchshop@0.7.5 contained malicious code in its postinstall hook that cloned an external repository from a personal GitHub account and executed arbitrary JavaScript during installation. The vulnerability allowed the controller of the external repository to execute code on every fresh install of the affected version.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gpt-terminal-cli (npm)
gpt-terminal-cli, an npm package advertised as an AI chat CLI, contains malicious code that installs a persistent remote access implant with extensive capabilities including reverse shell, credential theft, keylogging, and antiforensics. The implant communicates with a hardcoded C2 server and supports dynamic C2 rotation via DNS dead-drop.
npmCompromised packageMalicious commit