Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm)
The npm package statist-browser-typed-client-jumptaxi.feature.contacts contained malicious code that automatically downloads and executes attacker-controlled native binaries on package import. The package was identified by OpenSSF and published as a malicious package advisory.
- Disclosed
- Last updated
- Blast radius
- Any consumer importing the package on npm
- Ecosystems
- Attack vectors
- Affected entities
- statist-browser-typed-client-jumptaxi.feature.contactsnpm package containing malicious code
The npm package statist-browser-typed-client-jumptaxi.feature.contacts contained embedded malicious code designed to execute arbitrary native payloads on any system that imports the package. Upon require, the package's index.js loads a _vendor.js module that selects platform-specific staging paths and downloads binary executables from attacker-controlled infrastructure.
The malicious code reconstructs Cloudflare workers.dev hostnames at runtime from obfuscated string arrays and includes a DNS TXT covert-channel fallback mechanism that reassembles base64-encoded chunks from numbered subdomains under dl.well1.site. Downloaded binaries are written to temporary directories (/var/tmp or %TEMP%) under disguised filenames (.cache_, dotnet_diag_.exe, .analytics_state), marked executable (chmod 0755), and spawned detached via shell commands (/bin/sh -c or cmd.exe /c start).
No cryptographic verification of downloaded binaries was performed, and the infrastructure used was not controlled by the legitimate package publisher. This resulted in automatic remote code execution on any host that installed and imported the package.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- statist-browser-typed-client-jumptaxi.feature.contacts
- Domains
- dl.well1.site
Remediation
- Immediately uninstall statist-browser-typed-client-jumptaxi.feature.contacts from all systems
- Audit npm package.json and lock files for any dependency on this package
- Review system logs and process execution history on affected hosts for suspicious binary downloads and execution from /var/tmp, %TEMP%, or Cloudflare workers.dev origins
- Check for DNS queries to dl.well1.site or related subdomains
- Regenerate credentials and secrets on any affected systems
- Update npm to the latest version and run npm audit to identify other potentially compromised dependencies
Sources
- GitHub Advisory GHSA-j69g-vwwq-rrmf · GitHub Advisory Database
Cite this entry
"Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-statist-browser-typed-client-jumptaxi-feature-contacts-npm-0137bz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malware in leb128x
The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package