Malicious code in tinkoff-test-app-child-app (npm)
The npm package tinkoff-test-app-child-app version 20.3.8 contains malicious code that downloads and executes platform-specific binaries from untrusted external servers without integrity verification. It disguises these binaries under temporary filenames, sets executable permissions, and runs them detached from the main process. The package also includes a telemetry-like module that uses similar techniques to drop and execute malicious payloads. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated immediately.
AI Analysis
Technical Summary
The tinkoff-test-app-child-app npm package (version 20.3.8) includes malicious functionality that reconstructs endpoint hostnames from split strings to download platform-specific binaries from suspicious external domains. These binaries are saved to temporary directories with disguised filenames, permissions are set to executable, and they are spawned detached from the main process. The package's telemetry module mimics analytics SDK behavior but also drops and executes malicious code using obfuscated API calls and base64-buffer construction. The downloaded binaries are not verified by hash or pinned to trusted sources, indicating a high risk of arbitrary code execution and full system compromise.
Potential Impact
Systems with this package installed are at risk of full compromise due to arbitrary code execution from untrusted binaries. Attackers may gain persistent control over the affected system, potentially accessing all stored secrets and keys. The presence of this package implies that the system's integrity and confidentiality are severely undermined.
Mitigation Recommendations
Remove the tinkoff-test-app-child-app package version 20.3.8 immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a secure, uncompromised environment. Since the package downloads and executes unverified binaries, further forensic analysis and remediation may be necessary to ensure no residual malicious software remains.
Malicious code in tinkoff-test-app-child-app (npm)
Description
The npm package tinkoff-test-app-child-app version 20.3.8 contains malicious code that downloads and executes platform-specific binaries from untrusted external servers without integrity verification. It disguises these binaries under temporary filenames, sets executable permissions, and runs them detached from the main process. The package also includes a telemetry-like module that uses similar techniques to drop and execute malicious payloads. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated immediately.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The tinkoff-test-app-child-app npm package (version 20.3.8) includes malicious functionality that reconstructs endpoint hostnames from split strings to download platform-specific binaries from suspicious external domains. These binaries are saved to temporary directories with disguised filenames, permissions are set to executable, and they are spawned detached from the main process. The package's telemetry module mimics analytics SDK behavior but also drops and executes malicious code using obfuscated API calls and base64-buffer construction. The downloaded binaries are not verified by hash or pinned to trusted sources, indicating a high risk of arbitrary code execution and full system compromise.
Potential Impact
Systems with this package installed are at risk of full compromise due to arbitrary code execution from untrusted binaries. Attackers may gain persistent control over the affected system, potentially accessing all stored secrets and keys. The presence of this package implies that the system's integrity and confidentiality are severely undermined.
Defensive Guidance
Remove the tinkoff-test-app-child-app package version 20.3.8 immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a secure, uncompromised environment. Since the package downloads and executes unverified binaries, further forensic analysis and remediation may be necessary to ensure no residual malicious software remains.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12282
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-q659-qc8w-8m2x"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a74cfacbf8831d5391b21d1
Added to database: 08/06/2026, 18:17:16 UTC
Last enriched: 08/06/2026, 19:21:29 UTC
Last updated: 08/06/2026, 19:21:29 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.