MAL-2026-12255 Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in @tinkoff-react-bui/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24f7ab4d7d2586559c337934afd7370495bfad3915fbdc7ce528c06666a8101b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...