MalwarePublished 5 Aug 2026

tinkoff-pfp-atom-desktop-carousel (npm) · Malicious Code

Affects tinkoff-pfp-atom-desktop-carouselSource GCVE Database

Malicious package : remove tinkoff-pfp-atom-desktop-carousel and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12245

What to do

Remove tinkoff-pfp-atom-desktop-carousel from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-pfp-atom-desktop-carousel	Affected =20.8.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tinkoff-pfp-atom-desktop-carousel version 20.8.8 contains malicious code that downloads and executes attacker-controlled native binaries on the host system. It uses obfuscated runtime techniques to evade detection and spawns these binaries with elevated permissions, resulting in remote code execution. This compromises the host system fully, risking exposure of all stored secrets and keys.

Impact

Any system with this package installed or running should be considered fully compromised. The attacker gains remote code execution capabilities, allowing arbitrary code execution with the installer's privileges. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or persistence mechanisms.

Defensive guidance

Immediate removal of the package tinkoff-pfp-atom-desktop-carousel version 20.8.8 is required. All secrets and keys on the affected system must be rotated from a different, trusted machine. Due to the nature of the compromise, a full system reinstallation or forensic analysis is recommended to ensure complete eradication of malicious code.

Summary

The package tinkoff-pfp-atom-desktop-carousel (npm) version 20.8.8 is malicious. Upon requiring the package, it loads a loader script that selects a platform-specific asset and downloads a native binary from randomized Cloudflare Workers hosts and fallback DNS-TXT base64 encoded sources. The binary is saved to temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. The package uses runtime string reconstruction to evade static analysis. A second dropper with similar functionality is embedded in telemetry.js. This results in remote code execution on the installer's host. The package name impersonates a Tinkoff Bank internal scope to deceive users. Installing or running this package fully compromises the host.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:23 UTC

Technical details

References

Community reviews