tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci @20.1.2

Summary

On require() of the package, index.js loads _loader.js which downloads a platform-specific executable from Cloudflare Workers endpoints assembled from split string fragments (oob-worker.cf103-070.workers.dev and related tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site with a DNS TXT chunked-base64 fallback), writes it to /var/tmp or %TEMP% under disguising names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods 0755 on Unix, and spawns it detached via cmd.exe or /bin/sh. Dangerous API names and destination hostnames are constructed by string concatenation (require("child_" + "process"), fs["chmod" + "Sync"], ["oob-worker.","cf10",...].join("")) to evade static analysis. A stamp file at /tmp/.analytics_state gates re-execution to roughly once per ~20000s, and env vars DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK provide a cover-story opt-out. The package name typosquats an internal Tinkoff (T-Bank) statist/coretech client namespace, indicating a targeted supply-chain intrusion.

Source: amazon-inspector (c9d1b853fe0164696ce54aa2550929d727c9ea06d42925934efacf57aeae3ff7)