Malicious code in tinkoff-component-infopanel (npm)
The npm package tinkoff-component-infopanel contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers hosts upon installation. The package impersonates the Tinkoff brand and executes the dropper via top-level require() in index.js, compromising any system that installs it as a dependency.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed tinkoff-component-infopanel as a dependency
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-component-infopanelnpm package impersonating Tinkoff brand
The npm package tinkoff-component-infopanel was found to contain malicious code designed to download and execute arbitrary native binaries. Upon require of the package, a _platform.js module downloads platform-specific executables from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with DNS-TXT fallback resolution via *.dl.well1.site.
The downloaded binaries are written to masqueraded cache paths using cover-story names such as dotnet_diag_, .cache_, and .analytics_state, then made executable (chmod 0o755) and spawned detached via /bin/sh -c or cmd. The destination hostnames are assembled at runtime by joining string fragments to evade static pattern matching.
The package impersonates the Tinkoff brand while declaring an empty author, no repository, and a README labeling it as an 'internal' module. Critically, the malicious dropper executes via top-level require() from index.js, meaning importing this package as a dependency automatically executes the fetched binary on the installer's host without any hash or signature verification.
The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-fprc-5vxr-hqwp.
Indicators of compromise
- Packages
- tinkoff-component-infopanel
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- *.dl.well1.site
Remediation
- Immediately remove tinkoff-component-infopanel from all package.json files and dependency trees
- Audit npm install logs and CI/CD logs for any installations of tinkoff-component-infopanel
- Inspect systems that installed this package for unexpected processes, network connections, or suspicious binaries in cache directories (.cache_, .analytics_state, dotnet_diag_)
- Regenerate any credentials, signing keys, or secrets that may have been exposed on affected systems
- Review outbound network connections to Cloudflare Workers hosts (oob-worker.cf*.workers.dev) and *.dl.well1.site
- Update npm lockfiles and re-run clean installs from trusted sources
- Monitor for supply chain indicators of compromise from systems that installed this package
Sources
- GitHub Advisory GHSA-fprc-5vxr-hqwp · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-component-infopanel (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-component-infopanel-npm-4299vt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit