Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)

The npm package statist-browser-typed-client-nfs.grocery.mobile.events was found to contain malicious code that executes on package import. The main entry point (index.js) loads a platform-specific payload selector (_platform.js) that fetches opaque executable bytes from three anonymous Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev).

If the primary Cloudflare Workers hosts are unavailable, the malware falls back to a covert DNS TXT record exfiltration channel using subdomains under *.dl.well1.site (tin, tina, ldr, win). The fetched payloads are written to temporary directories (/var/tmp on Unix, %TEMP% on Windows) under disguised filenames (.cache_, dotnet_diag_.exe) with executable permissions, then spawned detached via shell commands.

The malware employs multiple obfuscation techniques to evade static analysis: destination hostnames and DNS domains are assembled at runtime from split string fragments (e.g., ["oob-w","orker.cf102-","baf.workers.de","v"].join("")), and stderr is silenced via a no-op logger. A sibling module (lib/telemetry.js, 81 KB) contains duplicate drop-and-exec primitives with concatenation-obfuscated API names. Marker files and environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) are used as cover stories, but the actual behavior is unconditional dropper execution.

The package was identified via Amazon Inspector and reported through GitHub Security Advisories (GHSA-3225-grxw-fx69).