Malicious code in tinkoff-ui-action (npm)
The npm package tinkoff-ui-action contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on package require, disguised as a React UI component library. The payload uses obfuscated APIs and runtime string assembly to evade static analysis.
- Disclosed
- Last updated
- Blast radius
- All users who installed tinkoff-ui-action and required the package, exposing their systems to arbitrary binary execution.
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-ui-actionnpm package containing malicious code in _compat.js and lib/telemetry.js
The npm package tinkoff-ui-action was found to contain malicious code in its main entry point (compat.js) and secondary payload runner (lib/telemetry.js). Upon require, the package downloads platform-specific binaries from Cloudflare Workers subdomains with hostnames assembled at runtime (e.g., oob-worker.cf*.workers.dev) to evade static analysis, with a DNS-TXT chunked-base64 fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site.\n\nThe fetched binaries are written to temporary directories (/tmp or %TEMP%) under cover filenames such as dotnet_diag.exe and .cache_, given execute permissions (0755 on POSIX), and spawned via shell commands (/bin/sh -c or cmd.exe /c start /b). The secondary payload in lib/telemetry.js uses obfuscated require() and fs API calls to provide an additional execution vector, labeled as an 'Analytics SDK'.\n\nNo hash or signature verification is performed, no user consent is requested, and the package is advertised as a React UI component library—a purpose entirely unrelated to fetching and executing native binaries. The use of runtime string-splitting for both hostnames and dangerous API names is deliberate anti-analysis obfuscation.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Domains
- oob-worker.cf*.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately uninstall tinkoff-ui-action from all systems and projects
- Audit npm package.json and lock files for any presence of tinkoff-ui-action
- Review system logs and process execution history for suspicious binary spawning from /tmp or %TEMP% directories
- Check for network connections to the identified malicious domains (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site, and Cloudflare Workers subdomains)
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use a reputable React UI component library as a replacement
- Enable npm package integrity verification and consider using npm audit to detect similar malicious packages
Sources
- GitHub Advisory GHSA-xhqw-rjf7-x6h2 · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-ui-action (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-ui-action-npm-uuzin0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in supersig (npm)
The supersig npm package contains malicious code in its published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source tree. The bundles execute a decrypt-and-execute chain at load time using a DES key from an unpinned mkb-manager dependency, allowing remote code execution on any consumer.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
npmAI agents & skillsMalicious commitCompromised package - resolvedcritical
Malicious code in stretchshop (npm)
The npm package stretchshop@0.7.5 contained malicious code in its postinstall hook that cloned an external repository from a personal GitHub account and executed arbitrary JavaScript during installation. The vulnerability allowed the controller of the external repository to execute code on every fresh install of the affected version.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gpt-terminal-cli (npm)
gpt-terminal-cli, an npm package advertised as an AI chat CLI, contains malicious code that installs a persistent remote access implant with extensive capabilities including reverse shell, credential theft, keylogging, and antiforensics. The implant communicates with a hardcoded C2 server and supports dynamic C2 rotation via DNS dead-drop.
npmCompromised packageMalicious commit