Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)

The npm package statist-browser-typed-client-sme.rko.tariffs.web contained malicious code designed to execute arbitrary binaries on systems where the package was installed. Upon require(), the index.js file loads compat.js, which determines the target platform and fetches an opaque binary payload from one of three obfuscated Cloudflare Workers domains (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev).\n\nIf HTTPS delivery fails, the malware falls back to a DNS TXT covert channel using domains under *.dl.well1.site (tin/tina/ldr/win.dl.well1.site). The fetched binary is written to a temporary file with a benign cover-story name (dotnet_diag.exe on Windows, /var/tmp/.cache_ on Unix), given execute permissions (chmod 0755), and spawned detached via shell commands (/bin/sh -c on Unix, cmd /c start on Windows).\n\nThe malware employs obfuscation techniques including runtime assembly of C2 hostnames from split-string arrays to evade static analysis. No signature or hash verification is performed on the downloaded payload. A cooldown marker is written to suppress re-execution. The package's stated purpose as a 'web adapter' bears no relation to its actual malicious functionality.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository (MAL-2026-13379).