MalwarePublished 5 Aug 2026

tinkoff-boxy-mobile-vivid-heading (npm) · Malicious Code

Affects tinkoff-boxy-mobile-vivid-headingSource GCVE Database

Malicious package : remove tinkoff-boxy-mobile-vivid-heading and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12075

What to do

Remove tinkoff-boxy-mobile-vivid-heading from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-boxy-mobile-vivid-heading	Affected =20.7.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tinkoff-boxy-mobile-vivid-heading version 20.7.5 contains malicious code that fetches and executes opaque native binaries from dynamically reconstructed Cloudflare Workers hosts and uses DNS-TXT record fallback channels to load additional payloads. The malicious code writes these binaries to temporary directories, sets executable permissions, and runs them detached from the main process. This behavior is disguised under a false 'device integration' purpose and includes a secondary module for telemetry that is not currently active. Installation of this package results in full system compromise, requiring immediate secret and key rotation and package removal.

Impact

Any system with this package installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code on the host, potentially leading to complete control over the system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the payloads.

Defensive guidance

Immediate removal of the tinkoff-boxy-mobile-vivid-heading package version 20.7.5 is required. All secrets, credentials, and keys stored on the affected system must be rotated from a separate, trusted environment. Due to the nature of the compromise, a full system investigation and potential rebuild are recommended to ensure no persistent malicious components remain.

Summary

The package tinkoff-boxy-mobile-vivid-heading@20.7.5 includes a runtime component that dynamically reconstructs hostnames to fetch opaque binary payloads over HTTPS from Cloudflare Workers domains. It also uses DNS-TXT record enumeration on specific domains to retrieve base64-encoded executable chunks, which it assembles, writes to disk as hidden files, sets executable permissions, and executes detached processes on both POSIX and Windows systems. A secondary module contains similar functionality under an 'Analytics SDK' guise but is not invoked in this version. The described behavior has no legitimate purpose and indicates a fully malicious package designed to compromise the host system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:24 UTC

Technical details

References

Community reviews