MAL-2026-12455

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-twork.tsales.nitro.metrics/MAL-2026-12455.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12455
Published
2026-08-05T12:30:57Z
Modified
2026-08-05T13:36:05.226004491Z
Summary
Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2)

On require(), index.js loads shim.js which selects a platform-specific payload path, fetches a native binary from Cloudflare Workers subdomains whose hostnames are assembled at runtime from string-array fragments joined with.join(""), or falls back to a DNS-TXT covert channel that queries c.<domain> and N.<domain> and base64-decodes the concatenated TXT records into binary. The retrieved bytes are written to /var/tmp or %TEMP% under a disguised name (.cache<rand> on Unix, dotnetdiag<rand>.exe on Windows), chmod'd to 0o755, and spawned detached via /bin/sh -c or cmd /c start. There is no pinning, no hash or signature verification, and the delivery hosts are anonymous Cloudflare Workers subdomains and a DNS-TXT channel — not a publisher-owned release surface. The hostname obfuscation and TXT-record covert channel are inconsistent with any legitimate observability or telemetry function.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "20.6.2"
            ],
            "import_time": "2026-08-05T13:08:37.384778813Z",
            "sha256": "1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T12:30:57Z",
            "id": "IN-MAL-2026-014686"
        }
    ]
}
References
Credits

Affected packages

npm / statist-browser-typed-client-twork.tsales.nitro.metrics

Package

Name
statist-browser-typed-client-twork.tsales.nitro.metrics
View open source insights on deps.dev
Purl
pkg:npm/statist-browser-typed-client-twork.tsales.nitro.metrics

Affected ranges

Affected versions

20.*
20.6.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "_shim.js",
            "sha256": "0e1d1b0ff78cf295095cf9b1b71c4d454f7d410f259e86d916ee004e5f83b8c7",
            "tlsh": "a7b1959a136630198bb0d7f4c7175816f65ae2637390c294f79ca9985fb312483b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-VBN/06edOnDwccr+33rPn9Bb9neqBxQVM4FKOPgquJPRq1SbH2DlmLTLhgxV9Tsx9OLwzTCV21NvXYBK6A4I1A==",
                "sha1": "49e3861f82d6dcc3fd481c5cbca491c091f2e805"
            },
            "filename": "statist-browser-typed-client-twork.tsales.nitro.metrics-20.6.2.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-twork.tsales.nitro.metrics/MAL-2026-12455.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]