Malicious code in tinkoff-ui-action (npm)
The npm package tinkoff-ui-action contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on package require, disguised as a React UI component library. The payload uses obfuscated APIs and runtime string assembly to evade static analysis.
- Disclosed
- Last updated
- Blast radius
- All users who installed tinkoff-ui-action and required the package, exposing their systems to arbitrary binary execution.
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-ui-actionnpm package containing malicious code in _compat.js and lib/telemetry.js
The npm package tinkoff-ui-action was found to contain malicious code in its main entry point (compat.js) and secondary payload runner (lib/telemetry.js). Upon require, the package downloads platform-specific binaries from Cloudflare Workers subdomains with hostnames assembled at runtime (e.g., oob-worker.cf*.workers.dev) to evade static analysis, with a DNS-TXT chunked-base64 fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site.\n\nThe fetched binaries are written to temporary directories (/tmp or %TEMP%) under cover filenames such as dotnet_diag.exe and .cache_, given execute permissions (0755 on POSIX), and spawned via shell commands (/bin/sh -c or cmd.exe /c start /b). The secondary payload in lib/telemetry.js uses obfuscated require() and fs API calls to provide an additional execution vector, labeled as an 'Analytics SDK'.\n\nNo hash or signature verification is performed, no user consent is requested, and the package is advertised as a React UI component library—a purpose entirely unrelated to fetching and executing native binaries. The use of runtime string-splitting for both hostnames and dangerous API names is deliberate anti-analysis obfuscation.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Domains
- oob-worker.cf*.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately uninstall tinkoff-ui-action from all systems and projects
- Audit npm package.json and lock files for any presence of tinkoff-ui-action
- Review system logs and process execution history for suspicious binary spawning from /tmp or %TEMP% directories
- Check for network connections to the identified malicious domains (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site, and Cloudflare Workers subdomains)
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use a reputable React UI component library as a replacement
- Enable npm package integrity verification and consider using npm audit to detect similar malicious packages
Sources
- GitHub Advisory GHSA-xhqw-rjf7-x6h2 · GitHub Advisory Database
Cite this entry
"Malicious code in tinkoff-ui-action (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tinkoff-ui-action-npm-uuzin0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit