MalwarePublished 5 Aug 2026

tinkoff-pfp-block-desktop-tabs (npm) · Malicious Code

Affects tinkoff-pfp-block-desktop-tabsSource GCVE Database

Malicious package : remove tinkoff-pfp-block-desktop-tabs and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12247

What to do

Remove tinkoff-pfp-block-desktop-tabs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-pfp-block-desktop-tabs	Affected =20.5.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'tinkoff-pfp-block-desktop-tabs' version 20.5.3 contains malicious code that downloads and executes platform-specific binaries without verification. It impersonates the Tinkoff brand and uses filenames mimicking legitimate Microsoft diagnostics tools to evade detection. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.

Impact

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, potentially accessing all secrets and keys stored on the system. Removal of the package alone does not guarantee eradication of all malicious components or persistence mechanisms.

Defensive guidance

Remove the 'tinkoff-pfp-block-desktop-tabs' package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted device. Due to the potential for full system compromise, consider rebuilding the affected system to ensure complete remediation.

Summary

The 'tinkoff-pfp-block-desktop-tabs' npm package (version 20.5.3) is malicious. Upon requiring the package, it loads a script that reconstructs endpoint hostnames and downloads platform-specific binaries via HTTPS. These binaries are saved under disguised names in temporary directories, given executable permissions, and executed detached from the main process. No hash or signature verification is performed on the downloaded binaries. A secondary module uses obfuscated code to perform similar actions. The package name falsely claims association with the Tinkoff brand. The dropped files mimic Microsoft diagnostic artifacts to blend in. This behavior results in full compromise of any system running the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:23 UTC

Technical details

References

Community reviews