Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)
The npm package tinkoff-statist-browser-typed-client-sme.compliance.web.events contains malicious code that downloads and executes platform-specific binary payloads on require. The package name mimics an internal Tinkoff namespace to evade detection and uses DNS TXT covert channels as a fallback delivery mechanism.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer installing this package; platform-specific binary execution on load affects Linux, macOS, and Windows systems.
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-statist-browser-typed-client-sme.compliance.web.eventsMalicious npm package with typosquat/dependency-confusion characteristics
The package tinkoff-statist-browser-typed-client-sme.compliance.web.events was published to npm with malicious intent. Upon require, the main entry point (index.js) unconditionally loads _init.js, which assembles hardcoded remote hosts from obfuscated string fragments and attempts to download a platform-specific binary payload via HTTPS.
The downloaded payload is written to temporary directories (/tmp on Unix, %TEMP% on Windows) under disguised filenames (.cache_ on Unix, dotnet_diag_.exe on Windows), made executable (chmod 0755), and spawned detached via shell commands (/bin/sh -c on Unix, cmd.exe on Windows).
If the HTTPS fetch fails, the malware falls back to a DNS TXT covert channel, resolving subdomains under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. TXT record fragments are base64-decoded and concatenated to reconstruct the executable payload. Identifiers such as 'child_process' and 'chmodSync' are assembled from split string fragments at runtime to evade static string-based detection.
The package name closely resembles legitimate Tinkoff internal npm namespaces, consistent with a typosquat or dependency-confusion attack. The declared purpose (event bus) is incompatible with downloading and executing opaque native binaries, indicating deceptive packaging.
Indicators of compromise
- Packages
- tinkoff-statist-browser-typed-client-sme.compliance.web.events
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately remove tinkoff-statist-browser-typed-client-sme.compliance.web.events from all package.json files and lock files
- Audit npm install logs and dependency trees to identify all projects that may have installed this package
- Regenerate all credentials, API keys, and secrets on any system where this package was installed
- Scan affected systems for the presence of disguised binaries in /tmp, %TEMP%, and other temporary directories
- Monitor network traffic for connections to the identified malicious domains (oob-worker.cf*.workers.dev, tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site)
- Review npm audit logs and consider using npm package lock verification to prevent similar attacks
- If this package was installed in production, treat affected systems as potentially compromised and perform forensic analysis
Sources
- GitHub Advisory GHSA-jj33-jprr-c96x · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-statist-browser-typed-client-sme-compliance-web-events-eoluwp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in redis-type-xyz (npm)
redis-type-xyz is a malicious npm package that impersonates Redis OM by copying its metadata while substituting a known-malicious ulid-xyz dependency. Installation triggers a postinstall hook that establishes C2 communication and enables system compromise including persistence and arbitrary code execution.
npmCompromised packageTyposquattingDependency confusion - containedcritical
Malicious code in sigchain-js (npm)
Malicious code was injected into the published npm package sigchain-js, executing arbitrary code on installation via DES-decrypted payloads from companion packages thedata and tchain-api. The attack also involved typosquatting axios to version 1.18.1, which does not exist in legitimate release history.
npmCompromised packageDependency confusionTyposquatting - resolvedhigh
Malicious code in affinequant (PyPI)
The affinequant package on PyPI contained malicious code that exfiltrated basic system information (hostname, path, username) to the package author upon installation or import. The package was part of a broader campaign of malicious packages on PyPI and communicated with a domain associated with malicious activity.
PyPICompromised packageTyposquattingDependency confusion - resolvedhigh
Malicious code in adandu (PyPI)
The PyPI package 'adandu' was identified as malicious, containing code to exfiltrate basic system information (hostname, path, username) upon installation or import. The package was part of a broader campaign of pentest-themed malicious packages and communicated with domains associated with malicious activity.
PyPICompromised packageTyposquattingDependency confusion