tinkoff-fb-service-prefill-profile-contact

{"modified":"2026-08-05T09:03:21Z","published":"2026-08-05T09:03:21Z","schema_version":"1.7.4","id":"MAL-2026-12243","summary":"Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f)\nOn require of the package's main entry, _vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under oob-worker.cfNNN-XXX.workers.dev (host strings assembled via split-and-join fragments to evade static analysis) and, on failure, reassembles a base64-encoded payload from sequential DNS TXT record lookups against subdomains of *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site). The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe,.analytics_state), chmod 0755, then spawned detached via `spawn('/bin/sh', ['-c', '<fp> &'])` on Unix or `spawn('cmd', ['/c','start','/b',...])` on Windows. There is no version pinning, no hash or signature verification, and comments frame the behavior as 'telemetry/analytics' unrelated to the package's advertised Tinkoff SDK prefill purpose. The DNS-TXT reassembly path is a covert delivery channel designed to bypass HTTPS egress filtering.\n","affected":[{"package":{"ecosystem":"npm","name":"tinkoff-fb-service-prefill-profile-contact"},"versions":["20.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"7d1109492f7f2a8996ec4792cbc45b0d942481d58cfd75236608f3c63ef3c1f4","tlsh":"9ab1a65606aa30188bf0dbe4cb17541af65be66333808294fb5ca9981f7312483b2dfc"}],"package_integrity":[{"filename":"tinkoff-fb-service-prefill-profile-contact-20.2.3.tgz","hashes":{"sha1":"9ef273aed898092565b1eee2b9bd6b7f05dfced3","sha512_sri":"sha512-Rbdi9nFNfQuX/BKetLBy9Cc7BTJZopXix9trc7S5iS9aJhyfSgQP8j+/ILoxQnjvYRwIRpj8nlFIO+qnujq8oA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tinkoff-fb-service-prefill-profile-contact/v/20.2.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014525","import_time":"2026-08-05T09:28:22.105403192Z","modified_time":"2026-08-05T09:03:21Z","sha256":"d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f","source":"amazon-inspector","versions":["20.2.3"]}]}}