tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events @20.2.5

Summary

The package's index.js unconditionally requires./_loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints (oob-worker.cf10{0-3}-*.workers.dev) with a DNS TXT fallback under *.dl.well1.site. Destination hostnames are reconstructed at runtime from arrays of substrings joined together to evade static analysis. The fetched binary is written to /tmp or %TEMP% under decoy names (dotnet_diag_*.exe, analytics_state), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe, granting the remote operator arbitrary code execution on any host that installs or imports this package. The package name is a long typosquat-shaped identifier impersonating internal Tinkoff namespacing.

Source: amazon-inspector (9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8)