MalwarePublished 5 Aug 2026

tinkoff-component-limits (npm) · Malicious Code

Affects tinkoff-component-limitsSource GCVE Database

Malicious package : remove tinkoff-component-limits and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12238

What to do

Remove tinkoff-component-limits from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-component-limits	Affected =20.4.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tinkoff-component-limits version 20.4.9 is a malicious package masquerading as a legitimate Tinkoff SDK but contains no valid functionality. Upon requiring the package, it downloads a platform-specific binary payload from hardcoded Cloudflare Workers subdomains and fallback DNS-TXT records. This payload is saved under disguised filenames in temporary directories, given executable permissions, and executed detached from the main process. Installation of this package results in full compromise of the host system, potentially exposing all stored secrets and keys. Removal of the package alone does not guarantee eradication of the malware or its persistence mechanisms.

Impact

Any system with this package installed or running is considered fully compromised. Attackers gain full control of the host, potentially accessing all stored secrets and keys. The malicious payload runs with the ability to execute arbitrary code, persist on the system, and evade detection through obfuscation. This can lead to severe confidentiality, integrity, and availability impacts. The compromise is severe enough that simply uninstalling the package does not ensure complete remediation.

Defensive guidance

Immediate removal of the tinkoff-component-limits package version 20.4.9 is required. All secrets, credentials, and keys stored on the compromised system must be rotated from a separate, trusted environment. Due to the full compromise risk, a full system reinstallation or forensic analysis is recommended to ensure complete removal of all malicious components. Monitoring for any suspicious activity related to this package should be conducted.

Summary

The tinkoff-component-limits npm package (version 20.4.9) is a malicious package that pretends to be a Tinkoff SDK but does not provide legitimate functionality. When loaded, it executes a script that dynamically constructs URLs to download a binary payload from multiple Cloudflare Workers subdomains, with DNS-TXT fallback domains. The downloaded payload is saved to temporary directories with obfuscated filenames, made executable, and then executed in a detached manner using system shell commands. This behavior effectively compromises the host system, granting attackers full control. The package's design includes evasion techniques such as runtime hostname assembly to avoid detection by static string scanning. Due to the full compromise, all secrets and keys on the affected system should be considered exposed and rotated from a clean environment. Removing the package does not guarantee removal of all malicious components.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:24 UTC

Technical details

References

Community reviews