MAL-2026-12046

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-test.jumpwork.circuitbreaker/MAL-2026-12046.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12046
Published
2026-08-05T01:33:18Z
Modified
2026-08-05T01:49:54.628060430Z
Summary
Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f)

On require() of the package's main entry, _compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from one of several Cloudflare Workers hosts whose names are reconstructed at runtime by joining small string fragments (e.g. oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c "<file> &" or cmd /c start /b. A DNS-TXT covert channel provides a fallback delivery path against *.dl.well1.site (tin/tina/ldr/win subdomains), retrieving a count record at c.<domain> and then base64-encoded chunks from <i>.<domain> that are concatenated and executed. A second, larger duplicate of the same dropper (dynamic child_"+"process require, chmod-plus-detached-spawn, DNS discovery, base64 buffer assembly) is shipped as lib/telemetry.js in the tarball. Hostname string-array obfuscation and decoy filenames (dotfile cache, dotnet_diag_*.exe) indicate intentional evasion; installing or importing this package executes attacker-controlled native code on the developer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T01:39:31.834519771Z",
            "sha256": "6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f",
            "modified_time": "2026-08-05T01:33:18Z",
            "id": "IN-MAL-2026-011501",
            "versions": [
                "20.8.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / statist-browser-typed-client-test.jumpwork.circuitbreaker

Package

Name
statist-browser-typed-client-test.jumpwork.circuitbreaker
View open source insights on deps.dev
Purl
pkg:npm/statist-browser-typed-client-test.jumpwork.circuitbreaker

Affected ranges

Affected versions

20.*
20.8.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "statist-browser-typed-client-test.jumpwork.circuitbreaker-20.8.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-B4lYwP1XRBe3TlBM3iai2+mDLFqOroSIXf4MUgWgXwlEdCXUh74biGC5d/zVCyX5NPmijkbAzkyoq2/E14+kuw==",
                "sha1": "7d4802c380b28ae7ebf87580738737ff25ac93dc"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "1cb1c89a166630298bb0d7f0871b4416f69bf5633740c2d4f69ca9941f76224c3b2efc",
            "sha256": "a0cf23abecae7dd6ddbe1cdc32b776d0f3895af86d729a9f49fb6f7f5fcaca03",
            "path": "_compat.js"
        },
        {
            "tlsh": "ed835055566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "eec25d189994eb47514a02b6aa48d91ff10807dc82116d265b07ab00412a836f",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-test.jumpwork.circuitbreaker/MAL-2026-12046.json"