Most malicious package campaigns are a numbers game, typosquatting popular libraries and waiting for a mistyped install. A campaign documented by CloudSEK is the opposite: 993 malicious npm packages, almost all of them named after the private internal libraries of one company, the Russian financial group Tinkoff, now trading as T-Bank.
CloudSEK tracks the activity as TXTBOOK and says its supply chain monitoring surfaced the first packages, from which its researchers pivoted to the staging infrastructure, the command and control estate and the final implant. Their full technical write-up lays out the chain.
An attack that knows its target
The technique is dependency confusion. If a company's build system asks a public registry for a package name it expects to find only on its own internal one, an attacker who has registered that name in public gets their code run inside the company's network. Strict prefix matching attributes 850 of the 993 names to T-Bank, according to CloudSEK, with most of the remainder generic banking platform names such as claims, deposits and cards; fewer than one percent point anywhere else.
The targeting is not guesswork on CloudSEK's part. The second-stage loader carries an obfuscated table of nine hostnames, and three of them belong to the victim rather than the attacker: T-Bank's internal artifact repository, its Linux package repository, and an alerting endpoint at CloudPayments, the payment processor T-Bank has wholly owned since 2023. Before contacting its own servers the loader resolves the bank's internal repository and continues only if it answers, so the malware effectively refuses to run anywhere except inside the target.
The package names themselves leak an internal service catalogue, embedding paths for payments, business banking conversions, investment accounting, leasing and data warehousing that CloudSEK says are not guessable strings. The operator also squatted the private siblings of T-Bank's own open source projects, registering names around the Tramvai application framework and the Taiga UI design system that the group publishes openly. Public repositories, in other words, gave the attacker a free and accurate map of what the private names would look like.
A payload delivered by DNS
The most distinctive part is delivery. Rather than fetching a binary over HTTP, where a proxy or download inspection might catch it, the loader reassembles a native executable from several hundred DNS TXT records, a few hundred bytes at a time. On a network monitor that looks like a burst of DNS lookups rather than a file transfer.
What arrives is a Sliver implant, a widely used post-exploitation framework, modified to encrypt with the age tool instead of Sliver's native scheme and to verify a signature on every server response. CloudSEK found the campaign runs two separate operator servers, split by platform, behind a shared front end of roughly two dozen Cloudflare accounts. Obfuscation was applied unevenly: the Windows and macOS builds have their strings encrypted, while the Linux builds carry the operator's keys and command and control hostname in plaintext on disk.
The campaign began on PyPI in July 2026 before moving to npm with its execution trigger rebuilt for the new ecosystem, and it has proved resistant to cleanup. When npm removed nine of the first ten names on August 1, publishing resumed roughly 25 hours later, and by August 3 three of those names carried live malicious versions again. The publishing accounts are disposable and mostly hold a single package each, so taking one down removes a package, not an operator.
What you should do
CloudSEK's guidance is that resolution policy, not blocklists, is what defeats dependency confusion: configure registry scoping so private package names can never resolve to the public registry. Organizations should also hunt DNS telemetry for sequentially numbered TXT lookups that reassemble into an executable, and treat any affected package appearing in a lockfile as a compromise, rotating every credential the build environment could reach. CloudSEK suggests pivoting on the operator's signing keys rather than hostnames, since those survive infrastructure rotation.
The campaign lands in a year of escalating registry attacks, from a self-spreading npm worm that reached 400 packages to credential-stealing hijacks of established libraries. What is new here is the precision: a whole private namespace reconstructed for one bank. Our Russia country profile tracks cyber activity affecting the region.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.