MAL-2026-12310

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-sme.platform.web.teasers/MAL-2026-12310.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12310
Published
2026-08-05T12:14:23Z
Modified
2026-08-05T12:34:50.265922970Z
Summary
Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027)

The package's declared main (index.js) unconditionally requires./init on load. init.js selects a platform-specific asset (win32/darwin/linuxx64/linuxarm64) and downloads a native binary over HTTPS from a rotating pool of Cloudflare Worker hosts whose hostnames are reassembled at runtime from split-literal arrays (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback via *.dl.well1.site. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache<hex> on POSIX, dotnetdiag<hex>.exe on Windows), chmod 0755'd on POSIX, and spawned detached via /bin/sh -c or cmd. childprocess is loaded via require("child_"+"process") in lib/telemetry.js to evade static analysis. There are no lifecycle scripts required — any require() or import of this package triggers download and execution of an unpinned, unauthenticated remote binary from anonymous infrastructure, giving the publisher arbitrary code execution on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014632",
            "import_time": "2026-08-05T12:15:14.405083792Z",
            "sha256": "30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027",
            "modified_time": "2026-08-05T12:14:23Z",
            "versions": [
                "20.4.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / statist-browser-typed-client-sme.platform.web.teasers

Package

Name
statist-browser-typed-client-sme.platform.web.teasers
View open source insights on deps.dev
Purl
pkg:npm/statist-browser-typed-client-sme.platform.web.teasers

Affected ranges

Affected versions

20.*
20.4.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-ysbxYhqNxZPhGn0jYsCINkbxEIPzE4vFKH51RLH3eTrY6Lf5B94bG2L6iuhSLllRhD4rPBSzEPUkVC4j1mRkIg==",
                "sha1": "3c741ebef336a2d8108a996c5058d24594324a6f"
            },
            "filename": "statist-browser-typed-client-sme.platform.web.teasers-20.4.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_init.js",
            "sha256": "28dca91dcc56b1eebbbea5cefccf62914e748694163a8dc9b86e0a82460139ad",
            "tlsh": "8ca1765a2666311c47b0a7e4871b4416f65bf2633381c5d4fb9ca5941f7262483b1efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-sme.platform.web.teasers/MAL-2026-12310.json"