tinkoff-boxy-desktop-two-panel-right-image @20.4.8
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12230
Ecosystem
npm
Summary
On require of this package, index.js loads _vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), downloads a platform-specific binary via https.get, and falls back to a covert channel that reconstructs a base64 payload from numbered DNS TXT records under tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site. The retrieved bytes are written to /tmp or %TEMP% under decoy names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and spawned detached via spawn('/bin/sh', ['-c', <path>+' &']) or cmd.exe /c start /b. A second module lib/telemetry.js, framed as an analytics SDK, ships the same base64-decode / chmodSync 0755 / detached spawn chain. The destinations are anonymous Cloudflare Workers subdomains and an unrelated DDNS-style domain; the fetched content is opaque native code executed on the installer's host with no verification.
Source: amazon-inspector (7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.