Malware in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events
Malware discovered in the npm package tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events. Any computer with this package installed is considered fully compromised and requires immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events
A malicious npm package named tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events has been identified as containing malware. The package was published to the npm registry and poses a critical threat to any system where it is installed or running.
According to the advisory, systems with this package installed should be considered fully compromised. The malware grants outside entities full control of affected computers, allowing potential theft of secrets and keys stored on those systems.
Immediate action is required to rotate all secrets and keys from a separate, uncompromised computer. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the package installation, given the level of system compromise.
Indicators of compromise
- Packages
- tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events
Remediation
- Immediately remove the package tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events from all systems
- Rotate all secrets, keys, and credentials from a different, uncompromised computer
- Perform a full security audit and malware scan of any affected systems
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Consider the affected systems as potentially fully compromised and plan for complete reimaging if critical systems are involved
Sources
- GitHub Advisory GHSA-4mrm-8v83-27p9 · GitHub Advisory Database
Cite this entry
"Malware in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malware-in-tinkoff-statist-browser-typed-client-itsa-candy-selfservicesupport-fr-3zgkcw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - activecritical
Malware in kit-hydration-vim
The npm package kit-hydration-vim contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - resolvedcritical
Malicious code in hunterone-build-probe-9210 (npm)
The npm package hunterone-build-probe-9210 contained malicious code that executed automatically via preinstall and postinstall hooks, collecting sensitive system and credential information and exfiltrating it to a third-party webhook endpoint.
npmCompromised package - containedcritical
Malicious code in harmony-app-toolkit (npm)
The npm package harmony-app-toolkit version 22.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with domains associated with malicious activity and executes commands consistent with malicious behavior.
npmCompromised package