Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab On require of the package, index.js loads runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints...

MAL-2026-12257 Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab On require of the package, index.js loads runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints...

MAL-2026-12246 Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...

Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...

Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

MAL-2026-12269 Malicious code in tinkoff-statist-browser-typed-client-mb.reliability.android.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c12f5330c144cfe67198d49d442d702f5e40977e1d607ab651d33dffb2d073 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path for Linux/macOS/Windows, downloads a...

Malicious code in tinkoff-statist-browser-typed-client-mb.reliability.android.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c12f5330c144cfe67198d49d442d702f5e40977e1d607ab651d33dffb2d073 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path for Linux/macOS/Windows, downloads a...

Malicious code in tinkoff-boxy-desktop-icons-horizontal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bc487e28e9156858508430946f9d90f9b2dd904390172ae905870c8bd6f40d0 The package's index.js unconditionally requires compat.js, which on module load fetches an opaque native binary from string-split-obfuscated Cloudfla...

Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

MAL-2026-12076 Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

MAL-2026-12048 Malicious code in tinkoff-boxy-desktop-features-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9792640803b7c90320c995d134baefcd36a52037d1947a3c0262c9d9e5ada168 The package's main entry index.js requires./setup at load time. setup.js assembles obfuscated Cloudflare Workers hostnames via array-join concatenati...

MAL-2026-12051 Malicious code in tinkoff-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembl...

Malicious code in tinkoff-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembl...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12049 Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in tinkoff-terminal-kit-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67091b6d7ee752850793817e0bf77d92b3bc16bff12d5348e81c1cb39cf6423 On require of the package, index.js loads adapter.js, which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of thr...

Malicious Package

Overview tinkoff-boxy-desktop-features-banner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview tinkoff-ui-action is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...