MalwarePublished 5 Aug 2026

tinkoff-statist-browser-typed-client-sme.users.origination.web (npm) · Malicious Code

Affects tinkoff-statist-browser-typed-client-sme.users.origination.webSource GCVE Database

Malicious package : remove tinkoff-statist-browser-typed-client-sme.users.origination.web and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:21 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12277

What to do

Remove tinkoff-statist-browser-typed-client-sme.users.origination.web from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-statist-browser-typed-client-sme.users.origination.web	Affected =20.6.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tinkoff-statist-browser-typed-client-sme.users.origination.web version 20.6.2 contains malicious code that downloads and executes a binary payload from obfuscated, non-publisher-controlled infrastructure. The payload is written to temporary directories, given executable permissions, and run detached via shell commands. The package uses obfuscation techniques to evade detection and includes a second dropper disguised as an analytics SDK. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.

Impact

Any computer with this package installed or running is considered fully compromised, as the malicious payload grants full control to an attacker. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by the payload.

Defensive guidance

Immediate removal of the package is recommended. All credentials and secrets on affected systems must be rotated from a secure environment. Due to the nature of the compromise, affected systems should be treated as fully compromised and rebuilt if possible. Monitor for any signs of persistent malicious activity.

Summary

This npm package's main entry point requires a loader script that downloads a platform-specific binary from obfuscated Cloudflare Workers hosts and a DNS-TXT fallback domain. The binary is saved to a disguised path in temporary directories, permissions are set to executable, and it is executed detached via shell commands. The package hides API names and hostnames using array-join concatenation to evade static detection. A second copy of the dropper is embedded in lib/telemetry.js under the guise of an Analytics SDK, using similar techniques. The fetched payload is opaque, unverified, and delivered from infrastructure outside the publisher's control, indicating a supply chain compromise or malicious package insertion. The package is branded as a Tinkoff internal client but communicates with unrelated external hosts.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:21 UTC

Technical details

References

Community reviews