delivery-ci-validate-tinkoff-fb

{"modified":"2026-08-05T13:54:38Z","published":"2026-08-05T13:54:38Z","schema_version":"1.7.4","id":"MAL-2026-12689","summary":"Malicious code in delivery-ci-validate-tinkoff-fb (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0)\nThe package presents itself as a CI validation helper but `index.js` calls `require('./_adapter')` on import, causing _adapter.js to run automatically. _adapter.js assembles C2 hostnames at runtime via `.join('')` over split fragments (resolving to `oob-worker.cf10{0..3}-*.workers.dev` with a `*.dl.wel1.ru` DNS-TXT base64 fallback), downloads a platform-specific binary with no version pin or integrity check, writes it to a hidden staging path (`/var/tmp/.cache_<hex>` on Unix, `%TEMP%/dotnet_diag_<hex>.exe` impersonating a Microsoft diagnostic tool on Windows), `chmod 0755`s it, and spawns it detached via `/bin/sh -c... &` or `cmd.exe /c start /b`. A filesystem cooldown marker (`analytics_state`) and telemetry-style naming are used as cover. The exported `validate()` function is a trivial stub unrelated to the dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"delivery-ci-validate-tinkoff-fb"},"versions":["35.6.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"d296a53a71a1b3756325fa88e7473fa8c64b24e970a5cd4d639b075abca94334","tlsh":"99a184560666b0188bb09be4c71b8829fa5ef6633380c294f75c69885f735248371efc"},{"path":"package.json","sha256":"a739a0266b0c9c658578f84352eaf97cb2996aa390f8dc9ba179ce990954bb05","tlsh":"a3d0a7128510612318f24ff04851a107b7620f5f1024bc8e71b3500845d5e7504ed322"}],"package_integrity":[{"filename":"delivery-ci-validate-tinkoff-fb-35.6.9.tgz","hashes":{"sha1":"21281e2bed24ec4bb53bf757e01298bbad477c1d","sha512_sri":"sha512-8AZcl+Q766RjlSFvvRg7UWaIUNAwnglBL6WXpItw9DpjFqlnAsOvAacBqPE65SUYt+6IyGUXazy2V+BXzkfFxg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delivery-ci-validate-tinkoff-fb/v/35.6.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015089","import_time":"2026-08-05T14:20:00.800901083Z","modified_time":"2026-08-05T13:54:38Z","sha256":"1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0","source":"amazon-inspector","versions":["35.6.9"]}]}}