Malicious code in tramvai-tinkoff-module-legacy-popup (npm)
The npm package tramvai-tinkoff-module-legacy-popup contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers hosts and DNS-TXT covert channels. The package impersonates the legitimate tramvai/tinkoff Russian-language open-source ecosystem.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer installing tramvai-tinkoff-module-legacy-popup
- Ecosystems
- Attack vectors
- Affected entities
- tramvai-tinkoff-module-legacy-popupMalicious npm package impersonating tramvai/tinkoff ecosystem
The npm package tramvai-tinkoff-module-legacy-popup was published with embedded malicious code designed to execute arbitrary binaries on installation. When the package is required, index.js loads setup.js, which selects a platform-specific payload from a hardcoded binary map and fetches it over HTTPS from attacker-controlled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, cf103-070.workers.dev, cf99-9b3.workers.dev).
The malicious code writes the fetched payload to a temporary directory using masquerading filenames (e.g., dotnet_diag_.exe, .cache_), sets executable permissions (0o755), and spawns the binary detached via /bin/sh or cmd. The setup.js also implements a DNS-TXT covert-channel fallback mechanism that reads chunk counts from TXT records and reassembles base64-encoded chunks from multiple DNS subdomains (c., 0., 1., etc. under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site) before executing the reconstructed binary.
The package exports only a stub class with no functionality matching the advertised 'tramvai tinkoff module' purpose, and lib/telemetry.js contains a parallel unused dropper helper. The package name is a typosquatting attack impersonating the legitimate tramvai/tinkoff Russian-language open-source ecosystem.
This incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- tramvai-tinkoff-module-legacy-popup
- Domains
- oob-worker.cf101-adf.workers.dev
- cf103-070.workers.dev
- cf99-9b3.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately uninstall tramvai-tinkoff-module-legacy-popup from all systems
- Audit npm package.json and lock files for any installations of this package
- Review system logs and process execution history for suspicious binary execution from temp directories
- Block outbound HTTPS connections to Cloudflare Workers hosts matching the pattern cf*-*.workers.dev
- Block DNS queries to subdomains under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site
- Use npm audit to identify any transitive dependencies on this package
- Consider using npm package signature verification and allowlisting for production environments
Sources
- GitHub Advisory GHSA-33jp-mp9g-xvw7 · GitHub Advisory Database
Cite this entry
"Malicious code in tramvai-tinkoff-module-legacy-popup (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tramvai-tinkoff-module-legacy-popup-npm-wclffe
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting