Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)
Source: amazon-inspector
On require() of the package's main entry, index.js transitively loads _platform.js, which selects a platform-specific payload URL, fetches opaque executable bytes from one of three anonymous Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), falls back to a base64-chunked DNS TXT covert channel under *.dl.well1.site (tin/tina/ldr/win subdomains), writes the bytes to /var/tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), sets 0755 permissions, and detach-spawns them via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or the Windows cmd equivalent. Destination hostnames and DNS domains are assembled at runtime from split string fragments (e.g. ["oob-w","orker.cf102-","baf.workers.de","v"].join(""), ["ldr.dl.w","el","l1.si","te"].join("")) to evade static analysis; the module also silences its own stderr via a no-op logger. Marker files (.analytics_state) and telemetry-style opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) are cover-story labeling — the actual behavior is unconditional dropper execution. A sibling module lib/telemetry.js (81 KB, not on the require graph from index.js) ships duplicate drop-and-exec primitives with concatenation-obfuscated API names (require("child_"+"process"), fs["chmod"+"Sync"](...)), staged for later invocation. The package name mimics an internal-scoped path (statist-browser-typed-client-nfs.grocery.mobile.events) consistent with a typosquat/dependency-confusion lure.
