MalwarePublished 5 Aug 2026

tinkoff-pfp-block-mobile-advert-footer (npm) · Malicious Code

Affects tinkoff-pfp-block-mobile-advert-footerSource GCVE Database

Malicious package : remove tinkoff-pfp-block-mobile-advert-footer and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12248

What to do

Remove tinkoff-pfp-block-mobile-advert-footer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-pfp-block-mobile-advert-footer	Affected =20.3.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tinkoff-pfp-block-mobile-advert-footer version 20.3.3 contains malicious code that, upon require(), silently loads a script which reconstructs attacker-controlled hostnames and downloads an unsigned platform-specific binary. This binary masquerades as a .NET diagnostic tool, is saved to temporary directories, made executable, and executed detached from the parent process. The package name impersonates legitimate internal tooling, but its only functional code is a dropper that facilitates remote code execution and persistence with anti-analysis evasion techniques. Any system with this package installed or running should be considered fully compromised.

Impact

Systems with this package installed or running are considered fully compromised. The attacker gains the ability to execute arbitrary unsigned binaries on the host, potentially leading to full system control. Secrets and keys stored on the compromised system may be exposed or stolen. Removing the package alone does not guarantee removal of all malicious components or backdoors, as the attacker may have established persistent access.

Defensive guidance

Immediate removal of the tinkoff-pfp-block-mobile-advert-footer package version 20.3.3 is recommended. However, due to the high likelihood of full system compromise, all secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Incident response should assume complete attacker control and include thorough system investigation and remediation.

Summary

The malicious npm package tinkoff-pfp-block-mobile-advert-footer (version 20.3.3) executes a multi-stage attack upon being required. It reconstructs attacker-controlled hostnames from fragmented strings and uses DNS-TXT records with base64 encoding as a fallback to download an unsigned binary over HTTPS. This binary is stored in temporary directories on Unix or Windows systems, given executable permissions, and launched detached from the parent process using shell commands. The package name is designed to impersonate Tinkoff internal tooling, but its actual functionality is limited to acting as a dropper for the malicious binary. The use of hostname reconstruction and DNS-TXT payload transport are deliberate anti-analysis evasion techniques. The presence of this package indicates a full system compromise, with potential unauthorized access to secrets and keys.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:23 UTC

Technical details

References

Community reviews