MalwarePublished 5 Aug 2026

tinkoff-fb-app-frame-page-height-dippy (npm) · Malicious Code

Affects tinkoff-fb-app-frame-page-height-dippySource GCVE Database

Malicious package : remove tinkoff-fb-app-frame-page-height-dippy and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12240

What to do

Remove tinkoff-fb-app-frame-page-height-dippy from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-fb-app-frame-page-height-dippy	Affected =20.8.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'tinkoff-fb-app-frame-page-height-dippy' version 20.8.4 contains malicious code that acts as a binary dropper. Upon requiring the package, it reconstructs command-and-control hostnames and downloads attacker-controlled native binaries which are saved and executed on the host system. This behavior is hidden through runtime string concatenation and evasion techniques. The package name and description do not reflect this malicious behavior. Systems with this package installed should be considered fully compromised.

Impact

Any system that has this package installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code, potentially leading to full system compromise. All secrets and keys stored on the affected system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the attacker.

Defensive guidance

Immediate removal of the 'tinkoff-fb-app-frame-page-height-dippy' package version 20.8.4 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a different, trusted machine. Because the package executes attacker-controlled native code, a full system compromise is likely; therefore, a comprehensive incident response including forensic analysis and system rebuild should be considered. Monitor vendor advisories for updates.

Summary

The 'tinkoff-fb-app-frame-page-height-dippy' npm package (version 20.8.4) includes code that, when required, dynamically reconstructs C2 server hostnames and downloads native binaries from anonymous Cloudflare Workers subdomains or via DNS TXT-record fallback. The downloaded payload is saved as a hidden file in temporary directories on POSIX or Windows systems, given executable permissions, and executed detached from the main process. The package uses string concatenation to evade static analysis. This results in execution of attacker-controlled native code on the host, effectively compromising the system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:24 UTC

Technical details

References

Community reviews