Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12247 Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12255 Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246 On require of this package, index.js loads vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments...

Malicious code in tinkoff-statist-browser-typed-client-sme.users.origination.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bfbb507be06c5d117ac6bfdff47a2441c2198b0d5702e4da97f598bc0d880a3 The package's main entry require's loader.js, which at import time downloads a per-platform binary from string-concatenation-obfuscated Cloudflare...

MAL-2026-12275 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8 The package's index.js unconditionally requires./loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8 The package's index.js unconditionally requires./loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints...

Malicious code in tinkoff-component-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e6bc0aab20cfeb6b8faa38c382fbf50d7675b65b0a56eea0977c45ae59ee7d7 The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require, index.js loads shim.js, which selects a...

MAL-2026-12245 Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...

Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...

MAL-2026-12248 Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...

Malicious code in tinkoff-codeceptjs-storyshots-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3112d2ca5a8472fa34cd7ca06332803889f72a195a05b3f98592e43decd66631 The package's index.js unconditionally requires bootstrap.js on load. bootstrap.js selects a platform-specific path linuxx64, linuxarm64, darwin,...

Malicious code in peter-desktop-peter-big-column (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7593cd2f0f03765e6debc06626ee5d771a32e0d7eb579ddca1bfc5ca53bc22e6 On require, index.js loads runtime.js which assembles download hostnames at runtime from split string fragments resolving to...

Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

MAL-2026-12216 Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

Malicious code in nolimit-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bb0b18aa83b740e2cb908b4dabf469e2447548d637dbc409f1e11f88ab6b534 Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under.ad/ are post-obfuscated wi...

Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...