tinkoff-pfp-atom-desktop-carousel @20.8.8

Summary

On require of this package, index.js loads _loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomized Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked base64 fallback via tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Host names, the child_process module reference (require("child_" + "process")), and the chmodSync call are reconstructed at runtime via string-split/join to defeat static scanners. A second dropper implementation is bundled at lib/telemetry.js (~81KB) reimplementing the same fetch-write-chmod-spawn chain with base64 chunk assembly. The package name impersonates a Tinkoff Bank internal scope. Installing or requiring this package yields remote code execution on the installer's host by attacker-controlled native binaries.

Source: amazon-inspector (72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd)