MAL-2026-12214

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-sme.platform.web.productsnavigation.events/MAL-2026-12214.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12214
Published
2026-08-05T08:56:53Z
Modified
2026-08-05T10:06:26.694492832Z
Summary
Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781)

Package's main entry loads adapter.js on require, which runs a bootstrap() function at module load. It selects a platform-specific endpoint (linuxx64, linuxarm64, darwin, win32), fetches an opaque binary over HTTPS from string-split-obfuscated Cloudflare Worker mirrors (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked fallback via *.dl.well1.site, writes the bytes to /var/tmp/.cache<rand> or %TEMP%\dotnetdiag<rand>.exe with disguised filenames mimicking system tools, chmods 0755, and spawns the file detached via /bin/sh or cmd. The mirror hostnames, resolver domains, and dangerous API references (require("child_"+"process"), fs["chmod"+"Sync"]) are assembled from split-string fragments to evade static scanners. lib/telemetry.js contains the same obfuscation pattern. The fetched executable is unverified and runs on any import of the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "versions": [
                "20.7.2"
            ],
            "sha256": "5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781",
            "import_time": "2026-08-05T09:28:17.110736875Z",
            "id": "IN-MAL-2026-014482",
            "modified_time": "2026-08-05T08:56:53Z"
        }
    ]
}
References
Credits

Affected packages

npm / statist-browser-typed-client-sme.platform.web.productsnavigation.events

Package

Name
statist-browser-typed-client-sme.platform.web.productsnavigation.events
View open source insights on deps.dev
Purl
pkg:npm/statist-browser-typed-client-sme.platform.web.productsnavigation.events

Affected ranges

Affected versions

20.*
20.7.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "statist-browser-typed-client-sme.platform.web.productsnavigation.events-20.7.2.tgz",
            "hashes": {
                "sha1": "c43dcf129287604ec4797e485188e8ea8f6765f2",
                "sha512_sri": "sha512-OQswxwGPEq2eTlJPE66hGEJ2IYCkLlODb4M/VhQesD1fE6a1mPPnxrjKL84Dt7+FOV4NZ99mJ7tVR50YY84+Ow=="
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "2577f15b000e2bbccdd1a916cf1a359d6b1e406695525c38413e0d2414fb2d10",
            "tlsh": "46a1b85a22a570198bb0abe4c71b5416f657f66333808284f75ca5d45fb2534c2b2efc",
            "path": "_adapter.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-sme.platform.web.productsnavigation.events/MAL-2026-12214.json"