Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)
The npm package statist-browser-typed-client-sme.platform.web.teasers contains malicious code that downloads and executes a platform-specific native binary from attacker-controlled infrastructure upon installation or require(). The attack uses obfuscation techniques including split-literal arrays for hostname reconstruction and child_process concatenation to evade static analysis.
- Disclosed
- Last updated
- Blast radius
- Any system that installs or requires this package; arbitrary code execution on host
- Ecosystems
- Attack vectors
- Affected entities
- statist-browser-typed-client-sme.platform.web.teasersnpm package containing malicious code
The npm package statist-browser-typed-client-sme.platform.web.teasers was found to contain malicious code that executes arbitrary binaries on the host system. Upon any require() or import of the package, the main entry point (index.js) unconditionally loads _init.js, which selects a platform-specific asset based on the operating system (win32, darwin, linux_x64, or linux_arm64).
The malicious code downloads a native binary over HTTPS from a rotating pool of Cloudflare Worker hosts with dynamically reassembled hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback via *.dl.well1.site. The downloaded binary is written to temporary directories (/tmp or %TEMP%) under disguised filenames (.cache_ on POSIX systems, dotnet_diag_.exe on Windows), made executable (chmod 0755 on POSIX), and spawned detached via shell commands.
The attacker employed obfuscation techniques to evade static analysis, including concatenating "child_" + "process" in lib/telemetry.js to avoid direct require("child_process") detection. No lifecycle scripts are required—any installation or import of the package triggers the download and execution of an unpinned, unauthenticated remote binary, granting the attacker arbitrary code execution on the installer's host.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- statist-browser-typed-client-sme.platform.web.teasers
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf102-baf.workers.dev
- dl.well1.site
Remediation
- Immediately uninstall the statist-browser-typed-client-sme.platform.web.teasers package from all systems
- Audit all systems where this package was installed for signs of compromise or unauthorized binary execution
- Review network logs for connections to the identified Cloudflare Worker hosts (oob-worker.cf*.workers.dev) and *.dl.well1.site domains
- Regenerate credentials and secrets on any affected systems
- Scan systems for persistence mechanisms or additional malware installed by the downloaded binaries
- Review npm audit logs and dependency trees to identify all projects that may have included this package
Sources
- GitHub Advisory GHSA-h8vv-5w47-jr68 · GitHub Advisory Database
Cite this entry
"Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-statist-browser-typed-client-sme-platform-web-teasers-npm-1jcuyy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in sui-move-rpc
Malware was discovered in the npm package sui-move-rpc, resulting in full system compromise of any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in userbotjs
The npm package userbotjs contained malware that could fully compromise any system on which it was installed. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in @junofficial/baileys
The npm package @junofficial/baileys contained malware that fully compromised any system with the package installed or running. The malicious package has been identified and removed from distribution.
npmCompromised package - containedcritical
Malware in leb128x
The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package