Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The npm package tinkoff-statist-browser-typed-client-sme.reporting.reporting was published with embedded malicious code designed to execute arbitrary native binaries on the host system. The package name was crafted to impersonate an internal Tinkoff scope, with unused telemetry code serving as cover.\n\nUpon installation or require(), the package's index.js loads vendor.js, which fetches platform-specific binary payloads from one of four Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev). Hostnames are assembled at runtime via string concatenation to evade static detection. DNS TXT-record fallback discovery is configured via tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site.\n\nThe fetched binary is written to a randomized temporary path with disguised names (.cache, dotnet_diag_.exe), made executable (chmod 0755 on POSIX), and executed detached via shell spawn. Sensitive API names (child_process, chmodSync) are reconstructed from array joins to defeat static code analysis. A 22822-second cooldown flag prevents repeated execution attempts.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.