@tink/tink-link-core (npm) · Malicious Code
Affects @tink/tink-link-coreSource GCVE Database
Malicious package : remove @tink/tink-link-core and rotate any secrets on hosts that installed it.
Data as of 18 Sep 2026, 01:12 UTC
Malicious package
Published to npm · OSV MAL-2026-16270
What to do
Remove @tink/tink-link-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@tink/tink-link-core | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf) The package impersonates the Tink open-banking SDK (name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage github.com/tink-link/core) but its actual behavior is host reconnaissance and DNS exfiltration. The package.json install script runs `node index.js`, and both the install entry and main entry load lib/core.js, which reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a prefix and a hardcoded domain as DNS labels, and issues a dns.resolve4() lookup. The destination hostname and module/API names are reconstructed at runtime from hex byte arrays via Buffer.from(...).toString('utf8') in lib/b02e30.js and lib/6ad264.js — the decoded domain is oob.algamil7x.xyz and the label prefix is tinkcore. Module names 'os','dns','process' and API names 'userInfo','hostname','cwd','resolve4' are loaded via module.constructor._load with hex-decoded strings to hide them from static review. DNS-based egress bypasses HTTP proxy and firewall controls. The beacon fires automatically on `npm install` (via the install lifecycle script) and again on `require()` of the package, giving the attacker installer username, hostname, and current working directory for every affected environment.