MalwarePublished 5 Aug 2026

tinkoff-volna-zustate (npm) · Malicious Code

Affects tinkoff-volna-zustateSource GCVE Database

Malicious package : remove tinkoff-volna-zustate and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:21 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12284

What to do

Remove tinkoff-volna-zustate from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtinkoff-volna-zustate	Affected =20.9.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'tinkoff-volna-zustate' version 20.9.2 is a malicious supply-chain dropper that impersonates the Tinkoff brand to trick users into installing it. Upon import, it loads a script that downloads a platform-specific binary from obfuscated Cloudflare Workers hosts, using a DNS-TXT covert channel fallback to evade detection. The payload is saved to temporary directories with disguised filenames, made executable, and launched detached from the main process. This results in full compromise of the host machine, potentially exposing all stored secrets and keys. Removal of the package does not guarantee eradication of the malware due to the extent of control gained by the attacker.

Impact

Any system with this package installed or running is considered fully compromised. Attackers gain full control over the host, potentially accessing all stored secrets and keys. The malicious payload executes with elevated privileges and persists beyond package removal, making remediation difficult. This poses a severe risk to confidentiality, integrity, and availability of affected systems.

Defensive guidance

Immediate removal of the 'tinkoff-volna-zustate' package version 20.9.2 is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted machine. Due to the full compromise risk, a full system forensic analysis and potential reimaging may be necessary. Monitor for any suspicious activity related to this package and avoid installing similarly named packages that impersonate trusted brands.

Summary

The 'tinkoff-volna-zustate' npm package (version 20.9.2) acts as a supply-chain dropper by executing attacker-controlled code immediately upon import. It downloads a platform-specific binary payload from obfuscated Cloudflare Workers URLs and a DNS-TXT covert channel fallback, reassembling base64 chunks from subdomains to evade static detection. The payload is saved under hidden staging paths in temporary directories, given executable permissions, and executed detached via shell commands. The package name and description impersonate the legitimate Tinkoff brand to facilitate dependency confusion attacks. This behavior indicates a deliberate attempt to fully compromise the host system, enabling attackers to gain persistent control and access to sensitive information.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:21 UTC

Technical details

References

Community reviews