Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)
The npm package statist-browser-typed-client-sme.platform.web.teasers contains malicious code that downloads and executes a platform-specific native binary from attacker-controlled infrastructure upon installation or require(). The attack uses obfuscation techniques including split-literal arrays for hostname reconstruction and child_process concatenation to evade static analysis.
- Disclosed
- Last updated
- Blast radius
- Any system that installs or requires this package; arbitrary code execution on host
- Ecosystems
- Attack vectors
- Affected entities
- statist-browser-typed-client-sme.platform.web.teasersnpm package containing malicious code
The npm package statist-browser-typed-client-sme.platform.web.teasers was found to contain malicious code that executes arbitrary binaries on the host system. Upon any require() or import of the package, the main entry point (index.js) unconditionally loads _init.js, which selects a platform-specific asset based on the operating system (win32, darwin, linux_x64, or linux_arm64).
The malicious code downloads a native binary over HTTPS from a rotating pool of Cloudflare Worker hosts with dynamically reassembled hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback via *.dl.well1.site. The downloaded binary is written to temporary directories (/tmp or %TEMP%) under disguised filenames (.cache_ on POSIX systems, dotnet_diag_.exe on Windows), made executable (chmod 0755 on POSIX), and spawned detached via shell commands.
The attacker employed obfuscation techniques to evade static analysis, including concatenating "child_" + "process" in lib/telemetry.js to avoid direct require("child_process") detection. No lifecycle scripts are required—any installation or import of the package triggers the download and execution of an unpinned, unauthenticated remote binary, granting the attacker arbitrary code execution on the installer's host.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- statist-browser-typed-client-sme.platform.web.teasers
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf102-baf.workers.dev
- dl.well1.site
Remediation
- Immediately uninstall the statist-browser-typed-client-sme.platform.web.teasers package from all systems
- Audit all systems where this package was installed for signs of compromise or unauthorized binary execution
- Review network logs for connections to the identified Cloudflare Worker hosts (oob-worker.cf*.workers.dev) and *.dl.well1.site domains
- Regenerate credentials and secrets on any affected systems
- Scan systems for persistence mechanisms or additional malware installed by the downloaded binaries
- Review npm audit logs and dependency trees to identify all projects that may have included this package
Sources
- GitHub Advisory GHSA-h8vv-5w47-jr68 · GitHub Advisory Database
Cite this entry
"Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-statist-browser-typed-client-sme-platform-web-teasers-npm-1jcuyy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-impl (npm)
The npm package sme-rko-finance-front-operations-feed-impl contained malicious code that downloads and executes platform-specific binary payloads via Cloudflare Workers or DNS-based staging channels. The malware obfuscates child_process imports and executes on require(), making it active upon installation.
npmCompromised package - containedcritical
Malicious code in sme-rko-finance-front-operations-overnight (npm)
The npm package sme-rko-finance-front-operations-overnight contains malicious code that downloads and executes attacker-controlled binaries from Cloudflare Workers hosts on package require. The payload uses obfuscation techniques to evade static analysis and includes environment-based gating to reduce detection.
npmCompromised package - containedcritical
Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)
The npm package sme-rko-finance-front-payment-registers-operations-domain contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package uses obfuscated string construction to hide command-and-control domains and implements a DNS-TXT fallback channel for payload delivery.
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-providers (npm)
The npm package sme-rko-finance-front-operations-providers contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers subdomains and DNS-TXT fallback channels upon require().
npmCompromised package