MAL-2026-12253 Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-volna-zustate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01865b8f060a3e4a24f34537d14ace960460519b2e5e3073083c7de9da63bd9e On require'tinkoff-volna-zustate', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12279 Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

MAL-2026-12268 Malicious code in tinkoff-statist-browser-typed-client-mb.product.tgeofencing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471fb9b5c8d45abc59ffda97063561b4882d28109c9959c717fbcd0d9f25c00d On require of this package, index.js loads platform.js which assembles remote hostnames at runtime by concatenating fragmented string arrays to hide...

Malicious code in tinkoff-statist-browser-typed-client-mb.product.tgeofencing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471fb9b5c8d45abc59ffda97063561b4882d28109c9959c717fbcd0d9f25c00d On require of this package, index.js loads platform.js which assembles remote hostnames at runtime by concatenating fragmented string arrays to hide...

MAL-2026-12244 Malicious code in tinkoff-mutual-mgm-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84bc64dc52d6f64a0673f548b3201cc6eed96ea71665ccd1fc1a41b29ac12cca On require'tinkoff-mutual-mgm-form', index.js loads compat.js, which selects a platform-specific asset path and fetches a native binary over HTTPS fr...

Malicious code in tinkoff-mutual-mgm-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84bc64dc52d6f64a0673f548b3201cc6eed96ea71665ccd1fc1a41b29ac12cca On require'tinkoff-mutual-mgm-form', index.js loads compat.js, which selects a platform-specific asset path and fetches a native binary over HTTPS fr...

MAL-2026-12247 Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in tinkoff-terminal-kit-test-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c68d83a8e515bebce3319c94274060bdfcef42f2ba45e96e87515c9cfd11e020 On require of [email protected], index.js loads adapter.js which selects a platform-specific endpoint, downloads an opaque...

MAL-2026-12281 Malicious code in tinkoff-terminal-kit-test-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c68d83a8e515bebce3319c94274060bdfcef42f2ba45e96e87515c9cfd11e020 On require of [email protected], index.js loads adapter.js which selects a platform-specific endpoint, downloads an opaque...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e Package presents itself as a trivial event bus index.js exports a small EventBus class but its main entry unconditionally requires./ext on load. ext....

MAL-2026-12276 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e Package presents itself as a trivial event bus index.js exports a small EventBus class but its main entry unconditionally requires./ext on load. ext....

Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

MAL-2026-12242 Malicious code in tinkoff-fb-rf-add-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788686e9aacdc59ec40f42563a7d9ba5020c75d6c724c8bf59623213b51df780 The package's main entry loads bootstrap.js on require, which downloads a platform-specific executable from string-fragment-obfuscated...

Malicious code in tinkoff-fb-rf-add-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788686e9aacdc59ec40f42563a7d9ba5020c75d6c724c8bf59623213b51df780 The package's main entry loads bootstrap.js on require, which downloads a platform-specific executable from string-fragment-obfuscated...

Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.smartcam (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edf869ab3e355848cb77fff3b129c2fe0b80e01286fe28783a0e66e064cee87e On require of the package, index.js loads loader.js which downloads a platform-specific native binary from Cloudflare workers.dev endpoints whose...

MAL-2026-12260 Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.smartcam (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edf869ab3e355848cb77fff3b129c2fe0b80e01286fe28783a0e66e064cee87e On require of the package, index.js loads loader.js which downloads a platform-specific native binary from Cloudflare workers.dev endpoints whose...

Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246 On require of this package, index.js loads vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments...