tinkoff-boxy-independent-kasko-form

{"modified":"2026-08-05T09:04:10Z","published":"2026-08-05T09:04:10Z","schema_version":"1.7.4","id":"MAL-2026-12233","summary":"Malicious code in tinkoff-boxy-independent-kasko-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc)\nOn require of the package, index.js loads _bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfuscation and downloads a platform-specific binary from Cloudflare Workers subdomains (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev). If HTTPS mirrors fail, resolveDns() reads a chunk count from c.<domain> TXT records and fetches base64-encoded payload chunks from N.tin.dl.well1.site TXT records, reassembling them into an executable. The payload is written to /tmp or %TEMP% under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via cp.spawn(\"/bin/sh\", [\"-c\", filePath + \" &\"]) or cmd equivalent on Windows. The package name references an unrelated 'kasko form' library, unrelated to the dropper behavior. lib/telemetry.js ships a second copy of the same drop-and-exec logic under an 'analytics SDK' cover story.\n","affected":[{"package":{"ecosystem":"npm","name":"tinkoff-boxy-independent-kasko-form"},"versions":["20.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"1a9c70ce3e5628d44b68dc24981123d0a85ba669622da060d0a06b9ad94ef02d","tlsh":"a8a1b79a12a570198b70dbe4c7178826f66af6633381c2c0f79c59944f736248371efc"},{"path":"lib/telemetry.js","sha256":"912fb5e84544b5d2e801283de9f9d30e4c5bc3377d936141a751eb6b6ca52ee7","tlsh":"18834055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"tinkoff-boxy-independent-kasko-form-20.1.3.tgz","hashes":{"sha1":"f73cf59673345595cc6b3a3465152a3077868922","sha512_sri":"sha512-SnvG+C8CVgHbYx2OOVRCeUtH+vcUNfWrMNFRKLrzdMyojEb07x8d670/GTkGrXAZczsSzx04XOLJTTDTmyE2PQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tinkoff-boxy-independent-kasko-form/v/20.1.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014531","import_time":"2026-08-05T09:28:22.641510359Z","modified_time":"2026-08-05T09:04:10Z","sha256":"873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc","source":"amazon-inspector","versions":["20.1.3"]}]}}