Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f On require of the package's main entry, vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under...

MAL-2026-12258 Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e012cccc354c615a7d3fc6f753b676fa6f56e1053170a6e24f173ad930008 Requiring this package triggers support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare...

MAL-2026-12255 Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

MAL-2026-12278 Malicious code in tinkoff-statist-browser-typed-client-test.softwarecenter.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9027d7179ebd421765074cbde727f3a3e358eb677a9a9125fb22ff6638fd799 The package's index.js requires./setup on module load. setup.js selects a platform-specific output path /var/tmp/.cache on unix, %TEMP%/dotnetdiag.ex...

Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-mb.reliability.android.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c12f5330c144cfe67198d49d442d702f5e40977e1d607ab651d33dffb2d073 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path for Linux/macOS/Windows, downloads a...

Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious Package

Overview tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there ...

Malicious code in @tinkoff-react-bui/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24f7ab4d7d2586559c337934afd7370495bfad3915fbdc7ce528c06666a8101b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...