tinkoff-cache-path

Details

**Severity:** Critical

**Affected versions:** `= 20.8.3`

## Source: amazon-inspector (9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b)
The package advertises itself as an in-memory cache utility, but index.js unconditionally requires _compat.js on load, which acts as a dropper. _compat.js selects a platform-specific endpoint from an obfuscated list of hosts assembled at runtime via Array.join (oob-worker.cf*.workers.dev and *.dl.well1.site), downloads an opaque native binary over HTTPS, and falls back to a DNS-TXT covert channel that queries a count record at c.<domain> and reassembles numbered base64 TXT chunks into an executable buffer. The payload is written under /var/tmp or %TEMP% with a disguised name (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod +x, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() or spawn("cmd",...). A.analytics_state marker file and DO_NOT_TRACK-shaped environment opt-outs are used as cover. The declared purpose (caching) has no relationship to fetching and executing a native binary from attacker-controlled infrastructure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/395ec2d79c042ecee6d2b5b992bc3f7715306ae8/osv/malicious/npm/tinkoff-cache-path/MAL-2026-12076.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/395ec2d79c042ecee6d2b5b992bc3f7715306ae8/osv/malicious/npm/tinkoff-cache-path/MAL-2026-12076.json
- https://www.npmjs.com/package/tinkoff-cache-path/v/20.8.3
- https://github.com/advisories/GHSA-9gcw-36vr-jw5g

Compromised versions (1)

• = 20.8.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.