🛡️ MAL-2026-12310 — statist-browser-typed-client-sme.platfor

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

Source: amazon-inspector

The package's declared main (index.js) unconditionally requires./_init on load. _init.js selects a platform-specific asset (win32/darwin/linux_x64/linux_arm64) and downloads a native binary over HTTPS from a rotating pool of Cloudflare Worker hosts whose hostnames are reassembled at runtime from split-literal arrays (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback via *.dl.well1.site. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd on POSIX, and spawned detached via /bin/sh -c or cmd. child_process is loaded via require("child_"+"process") in lib/telemetry.js to evade static analysis. There are no lifecycle scripts required — any require() or import of this package triggers download and execution of an unpinned, unauthenticated remote binary from anonymous infrastructure, giving the publisher arbitrary code execution on the installer's host.