MAL-2026-12045

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-hra.workplacer.events/MAL-2026-12045.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12045
Published
2026-08-05T01:35:51Z
Modified
2026-08-05T01:49:53.260326726Z
Summary
Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8)

On require of the package's main entry (index.js), polyfill.js downloads a platform-specific binary from one of several hosts whose names are reconstructed at runtime by joining string fragments (resolving to oob-worker.cf102-baf.workers.dev and similar Cloudflare Workers subdomains), with a DNS TXT-record fallback resolving to *.dl.well1.site. The fetched bytes are written to /var/tmp/.cache<rand> on Unix or %TEMP%\dotnetdiag<rand>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start. Host and API names (childprocess, chmodSync) are split across array literals and reassembled at runtime to evade static analysis. A sibling file lib/telemetry.js, labeled as an Analytics SDK, ships the same dropper primitives (detached shell spawn of a written file, chmod 0755, base64 chunk assembly, DNS-based service discovery) as an alternate loader. The package advertises itself as an event-emitter client, and the fetched binaries have disguised names (cache file, dotnetdiag) unrelated to that stated purpose. The result is arbitrary remote code execution on any machine that installs or imports this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T01:39:31.988849097Z",
            "modified_time": "2026-08-05T01:35:51Z",
            "sha256": "c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8",
            "id": "IN-MAL-2026-011506",
            "versions": [
                "20.9.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / statist-browser-typed-client-hra.workplacer.events

Package

Name
statist-browser-typed-client-hra.workplacer.events
View open source insights on deps.dev
Purl
pkg:npm/statist-browser-typed-client-hra.workplacer.events

Affected ranges

Affected versions

20.*
20.9.1

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Aibdsv/twNx1iVpWbL5FLRqbhwftiyfdjUBY1mr51YUrgd9FWKqhIbOEc91lEvFUozyO60ei+aqncXd0VCDrrA==",
                "sha1": "2f01ab4d24d87189c9e87d7b8aa381bfa70faf13"
            },
            "filename": "statist-browser-typed-client-hra.workplacer.events-20.9.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "sha256": "bfaebfa2fe6be029dd2d2ba96802e97e901651cba2262bd815a6179eac47a84e",
            "tlsh": "aeb1ba5a169a70198bb09be4871b5425f667e2633380c1d4fb5ca9981f7713883b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "ff70a6c752035af9219bafc96155038550bba515ce9dcfb23f4296f184b69079",
            "tlsh": "82835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-hra.workplacer.events/MAL-2026-12045.json"