MAL-2026-12074

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-nfs.grocery.mobile.events/MAL-2026-12074.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12074
Published
2026-08-05T01:39:33Z
Modified
2026-08-05T03:20:55.113988298Z
Summary
Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce)

On require() of the package's main entry, index.js transitively loads platform.js, which selects a platform-specific payload URL, fetches opaque executable bytes from one of three anonymous Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), falls back to a base64-chunked DNS TXT covert channel under *.dl.well1.site (tin/tina/ldr/win subdomains), writes the bytes to /var/tmp or %TEMP% under disguised names (.cache<rand>, dotnetdiag<rand>.exe), sets 0755 permissions, and detach-spawns them via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or the Windows cmd equivalent. Destination hostnames and DNS domains are assembled at runtime from split string fragments (e.g. ["oob-w","orker.cf102-","baf.workers.de","v"].join(""), ["ldr.dl.w","el","l1.si","te"].join("")) to evade static analysis; the module also silences its own stderr via a no-op logger. Marker files (.analyticsstate) and telemetry-style opt-out env vars (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOTTRACK) are cover-story labeling — the actual behavior is unconditional dropper execution. A sibling module lib/telemetry.js (81 KB, not on the require graph from index.js) ships duplicate drop-and-exec primitives with concatenation-obfuscated API names (require("child_"+"process"), fs"chmod"+"Sync"), staged for later invocation. The package name mimics an internal-scoped path (statist-browser-typed-client-nfs.grocery.mobile.events) consistent with a typosquat/dependency-confusion lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T03:11:15.3289356Z",
            "sha256": "8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce",
            "id": "IN-MAL-2026-011508",
            "modified_time": "2026-08-05T01:39:33Z",
            "versions": [
                "20.3.3"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / statist-browser-typed-client-nfs.grocery.mobile.events

Package

Name
statist-browser-typed-client-nfs.grocery.mobile.events
View open source insights on deps.dev
Purl
pkg:npm/statist-browser-typed-client-nfs.grocery.mobile.events

Affected ranges

Affected versions

20.*
20.3.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-nfs.grocery.mobile.events/MAL-2026-12074.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-DhbD6STJokpel+XRQjKGHFTFd0PkE1AXS9NFZztDcu7RpDF9th8bliVjsrxb90LE/KHfsauD2LttlTcNYrRYkg==",
                "sha1": "8568997d018b6c962f4f5c42ba1a63a6ef9fce89"
            },
            "filename": "statist-browser-typed-client-nfs.grocery.mobile.events-20.3.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "b8a1b99a126a71194bb0ebe4c71b4419f65af2633781c585fb9c55881fb312483b2ffc",
            "path": "_platform.js",
            "sha256": "eea26defc833234f9c0d5633a1064ae924d7f7299a99ec834b4b73b5b13edc04"
        },
        {
            "tlsh": "36835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "path": "lib/telemetry.js",
            "sha256": "1c6b090a70c4a7e54837093a98f1b1eef1e8e79029041f7d1b6d551d52355894"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]