MAL-2026-12264 Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0 Package main entry require's./adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string...

MAL-2026-12272 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189b38f890bbf70f19838f7da330c3bf2798028f8cdc600bc58b5e38419e7795 On require of index.js the package loads vendor.js, which selects a platform-specific payload linux/darwin/win32, downloads it over HTTPS from...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189b38f890bbf70f19838f7da330c3bf2798028f8cdc600bc58b5e38419e7795 On require of index.js the package loads vendor.js, which selects a platform-specific payload linux/darwin/win32, downloads it over HTTPS from...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698cb702f4e52ddb67226e8681dc3a11228f43cd11b47516329e16b8ae3de436 The package typosquats an internal Tinkoff scope name. On require, index.js loads init.js, which builds attacker hostnames at runtime from...

Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

MAL-2026-12253 Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-volna-zustate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01865b8f060a3e4a24f34537d14ace960460519b2e5e3073083c7de9da63bd9e On require'tinkoff-volna-zustate', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

MAL-2026-12229 Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aedad3d882cc46a8a5a8189109dd03f3943c887644c308bee19791663c93a237 On require of the package, index.js loads bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers...

MAL-2026-12274 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aedad3d882cc46a8a5a8189109dd03f3943c887644c308bee19791663c93a237 On require of the package, index.js loads bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers...

MAL-2026-12276 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e Package presents itself as a trivial event bus index.js exports a small EventBus class but its main entry unconditionally requires./ext on load. ext....

Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e012cccc354c615a7d3fc6f753b676fa6f56e1053170a6e24f173ad930008 Requiring this package triggers support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.smartcam (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edf869ab3e355848cb77fff3b129c2fe0b80e01286fe28783a0e66e064cee87e On require of the package, index.js loads loader.js which downloads a platform-specific native binary from Cloudflare workers.dev endpoints whose...

Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246 On require of this package, index.js loads vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd094a1c3c67af1fc7372e62ed565847fcf26962f3b90e53a5df200390c07a99 On require/import, index.js loads bridge.js which selects a platform-specific endpoint and downloads an opaque executable over HTTPS from hardcoded...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8 The package's index.js unconditionally requires./loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints...

MAL-2026-12262 Malicious code in tinkoff-statist-browser-typed-client-investing.product.pulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17004ada8eaa4739f6095affbf19161081358a290ddfa0d0e8ff92a11436e731 The package's main entrypoint index.js unconditionally requires bootstrap.js, which downloads a platform-specific executable from a rotating list of...

Malicious code in tinkoff-statist-browser-typed-client-investing.product.pulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17004ada8eaa4739f6095affbf19161081358a290ddfa0d0e8ff92a11436e731 The package's main entrypoint index.js unconditionally requires bootstrap.js, which downloads a platform-specific executable from a rotating list of...

Malicious code in tinkoff-statist-browser-typed-client-investaccounting.events.templatepage.mainpage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01843210cccc7d6327d870fbe2f8d53a493aa8d1db525de7473f30f97ea9dcdb On require of the package, index.js loads bridge.js which assembles Cloudflare Workers hostnames by joining split string fragments e.g...