Malicious code in tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 801b453825e385d0c0c659b2037a6f8fcbcdfa0c0ae519ae103280639cd8ed99 Package name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./init on load; init.js selects a...

Malicious code in tinkoff-test-app-child-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46ce48be2d5927c06822c9e9497869a7da10c7b183b18df3c87c983863838ec8 On require of this package, platform.js reconstructs endpoint hostnames from split string arrays via.join"", downloads a platform-specific binary fro...

MAL-2026-12282 Malicious code in tinkoff-test-app-child-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46ce48be2d5927c06822c9e9497869a7da10c7b183b18df3c87c983863838ec8 On require of this package, platform.js reconstructs endpoint hostnames from split string arrays via.join"", downloads a platform-specific binary fro...

MAL-2026-12280 Malicious code in tinkoff-terminal-kit-datetime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ff5d079ddd6e9ef6bd552f3a33ec5d0c87dcad3dce14013cbf28cbaa37a1dc1 The package's main index.js unconditionally requires runtime.js, which on any require/import selects a platform-specific endpoint and downloads an...

Malicious code in tinkoff-terminal-kit-datetime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ff5d079ddd6e9ef6bd552f3a33ec5d0c87dcad3dce14013cbf28cbaa37a1dc1 The package's main index.js unconditionally requires runtime.js, which on any require/import selects a platform-specific endpoint and downloads an...

Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520 The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at ext.js that is loaded via index.js on require. On...

MAL-2026-12238 Malicious code in tinkoff-component-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e6bc0aab20cfeb6b8faa38c382fbf50d7675b65b0a56eea0977c45ae59ee7d7 The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require, index.js loads shim.js, which selects a...

Malicious code in tinkoff-component-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e6bc0aab20cfeb6b8faa38c382fbf50d7675b65b0a56eea0977c45ae59ee7d7 The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require, index.js loads shim.js, which selects a...

Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...

MAL-2026-12248 Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...

MAL-2026-12271 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

Malicious code in tinkoff-codeceptjs-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...

MAL-2026-12235 Malicious code in tinkoff-boxy-mobile-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490 On require of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments...

Malicious code in tinkoff-boxy-mobile-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490 On require of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments...

Malicious code in tinkoff-codeceptjs-storyshots-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3112d2ca5a8472fa34cd7ca06332803889f72a195a05b3f98592e43decd66631 The package's index.js unconditionally requires bootstrap.js on load. bootstrap.js selects a platform-specific path linuxx64, linuxarm64, darwin,...

MAL-2026-12215 Malicious code in statist-browser-typed-client-sme.salary.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66329f83c07140aacf28b612ad7211b0279deeef95014e0720b4c7be3097a3fe On require, adapter.js fetches a platform-specific binary payload from split-string-obfuscated Cloudflare Workers hosts...

Malicious code in statist-browser-typed-client-sme.salary.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66329f83c07140aacf28b612ad7211b0279deeef95014e0720b4c7be3097a3fe On require, adapter.js fetches a platform-specific binary payload from split-string-obfuscated Cloudflare Workers hosts...

MAL-2026-12214 Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781 Package's main entry loads adapter.js on require, which runs a bootstrap function at module load. It selects a platform-specific endpoint linuxx64,...

Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781 Package's main entry loads adapter.js on require, which runs a bootstrap function at module load. It selects a platform-specific endpoint linuxx64,...

Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...