npm · Malicious package advisory
Malware@tink/tink-link-core
GHSA-hvcc-qwg6-972c
Malicious code in @tink/tink-link-core (npm)
Details
**Severity:** Critical
**Affected versions:** `= 9.9.10`
## Source: amazon-inspector (826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf)
The package impersonates the Tink open-banking SDK (name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage github.com/tink-link/core) but its actual behavior is host reconnaissance and DNS exfiltration. The package.json install script runs `node index.js`, and both the install entry and main entry load lib/core.js, which reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a prefix and a hardcoded domain as DNS labels, and issues a dns.resolve4() lookup. The destination hostname and module/API names are reconstructed at runtime from hex byte arrays via Buffer.from(...).toString('utf8') in lib/b02e30.js and lib/6ad264.js — the decoded domain is oob.algamil7x.xyz and the label prefix is tinkcore. Module names 'os','dns','process' and API names 'userInfo','hostname','cwd','resolve4' are loaded via module.constructor._load with hex-decoded strings to hide them from static review. DNS-based egress bypasses HTTP proxy and firewall controls. The beacon fires automatically on `npm install` (via the install lifecycle script) and again on `require()` of the package, giving the attacker installer username, hostname, and current working directory for every affected environment.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3993d521acd1486d7f417803e3ab35e8ab0de7a0/osv/malicious/npm/@tink/tink-link-core/MAL-2026-16270.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/3993d521acd1486d7f417803e3ab35e8ab0de7a0/osv/malicious/npm/@tink/tink-link-core/MAL-2026-16270.json
- https://www.npmjs.com/package/@tink/tink-link-core/v/9.9.10
- https://github.com/advisories/GHSA-hvcc-qwg6-972cCompromised versions (1)
- = 9.9.10
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.