Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)
The npm package tinkoff-statist-browser-typed-client-sme.compliance.web.events contains malicious code that downloads and executes platform-specific binary payloads on require. The package name mimics an internal Tinkoff namespace to evade detection and uses DNS TXT covert channels as a fallback delivery mechanism.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer installing this package; platform-specific binary execution on load affects Linux, macOS, and Windows systems.
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-statist-browser-typed-client-sme.compliance.web.eventsMalicious npm package with typosquat/dependency-confusion characteristics
The package tinkoff-statist-browser-typed-client-sme.compliance.web.events was published to npm with malicious intent. Upon require, the main entry point (index.js) unconditionally loads _init.js, which assembles hardcoded remote hosts from obfuscated string fragments and attempts to download a platform-specific binary payload via HTTPS.
The downloaded payload is written to temporary directories (/tmp on Unix, %TEMP% on Windows) under disguised filenames (.cache_ on Unix, dotnet_diag_.exe on Windows), made executable (chmod 0755), and spawned detached via shell commands (/bin/sh -c on Unix, cmd.exe on Windows).
If the HTTPS fetch fails, the malware falls back to a DNS TXT covert channel, resolving subdomains under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. TXT record fragments are base64-decoded and concatenated to reconstruct the executable payload. Identifiers such as 'child_process' and 'chmodSync' are assembled from split string fragments at runtime to evade static string-based detection.
The package name closely resembles legitimate Tinkoff internal npm namespaces, consistent with a typosquat or dependency-confusion attack. The declared purpose (event bus) is incompatible with downloading and executing opaque native binaries, indicating deceptive packaging.
Indicators of compromise
- Packages
- tinkoff-statist-browser-typed-client-sme.compliance.web.events
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately remove tinkoff-statist-browser-typed-client-sme.compliance.web.events from all package.json files and lock files
- Audit npm install logs and dependency trees to identify all projects that may have installed this package
- Regenerate all credentials, API keys, and secrets on any system where this package was installed
- Scan affected systems for the presence of disguised binaries in /tmp, %TEMP%, and other temporary directories
- Monitor network traffic for connections to the identified malicious domains (oob-worker.cf*.workers.dev, tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site)
- Review npm audit logs and consider using npm package lock verification to prevent similar attacks
- If this package was installed in production, treat affected systems as potentially compromised and perform forensic analysis
Sources
- GitHub Advisory GHSA-jj33-jprr-c96x · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-statist-browser-typed-client-sme-compliance-web-events-eoluwp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion - resolvedcritical
Malicious code in cspell-esm (npm)
cspell-esm, a typosquatting package on npm resembling the legitimate 'cspell' library, contained malicious code delivered through a smuggled off-registry dependency (ltidisafe) hosted on a Google Cloud Storage bucket. Installation triggered execution of lifecycle scripts and code from the attacker-controlled dependency.
npmCompromised packageTyposquattingDependency confusion - containedcritical
Malicious code in @depup/astro (npm)
@depup/astro is a malicious npm package that impersonates the legitimate Astro framework by spoofing author and repository metadata, while systematically replacing well-known dependencies with lookalike packages under different maintainers. The package source code was rewritten to import from these lookalike packages, causing normal npm installs to execute attacker-controlled code instead of legitimate upstream dependencies.
npmTyposquattingDependency confusionCompromised package