Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)
The npm package statist-browser-typed-client-test.jumpwork.circuitbreaker contained malicious code that downloads and executes native binaries on developer machines. The dropper uses obfuscated Cloudflare Workers URLs and DNS-TXT covert channels to retrieve and execute attacker-controlled payloads.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed or imported the malicious package version
- Ecosystems
- Attack vectors
- Affected entities
- statist-browser-typed-client-test.jumpwork.circuitbreakernpm package containing malicious dropper code
The npm package statist-browser-typed-client-test.jumpwork.circuitbreaker was found to contain intentionally malicious code designed to execute arbitrary native binaries on systems where it is installed or imported.
Upon require() of the package, the _compat.js file executes as a side effect and selects a platform-specific payload. It then fetches a native binary over HTTPS from obfuscated Cloudflare Workers hosts (e.g., oob-worker.cf102-baf.workers.dev) whose names are reconstructed at runtime from string fragments. The binary is written to /tmp/.cache_ on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, made executable, and spawned detached.
A secondary dropper mechanism is embedded in lib/telemetry.js with identical functionality. The package also implements a DNS-TXT covert channel fallback using *.dl.well1.site subdomains (tin/tina/ldr/win) to retrieve base64-encoded payload chunks that are concatenated and executed.
The use of hostname obfuscation, decoy filenames mimicking legitimate tools (dotnet_diag), and multiple delivery mechanisms indicates intentional evasion. Installation or import of this package results in execution of attacker-controlled code on the developer's machine.
Indicators of compromise
- Packages
- statist-browser-typed-client-test.jumpwork.circuitbreaker
- Domains
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf100-416.workers.dev
- dl.well1.site
Remediation
- Immediately uninstall the package from all systems: npm uninstall statist-browser-typed-client-test.jumpwork.circuitbreaker
- Audit all systems where this package was installed for signs of compromise, including unexpected processes, network connections to Cloudflare Workers or well1.site domains, and suspicious files in /tmp or %TEMP%
- Review package.json and lock files to identify all affected projects and dependencies
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Monitor for indicators of compromise including connections to oob-worker.cf*.workers.dev and *.dl.well1.site domains
- Use npm audit to check for other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-cwf6-c7v4-rv74 · GitHub Advisory Database
Cite this entry
"Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-statist-browser-typed-client-test-jumpwork-circuitbreaker-npm-1a64rb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in ladash-cli (npm)
ladash-cli is a typosquat package on npm that executes malicious code during installation. The postinstall script downloads and executes a Windows binary, with special handling for WSL environments to compromise the underlying Windows host.
npmTyposquattingCompromised package - containedcritical
Malicious code in comand (npm)
The npm package 'comand' contained malicious code that executed automatically on install via postinstall.js, exfiltrating platform information and downloading an unsigned executable (main.exe) to Windows systems or via WSL PowerShell bridges. The package name appears to be a typosquat of 'command', and the GitHub owner (braz1) does not match the npm publisher.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in core-js-gns (npm)
The npm package core-js-gns contained malicious code in its postinstall hook that exfiltrated system information and executed remotely-fetched Python code on developer machines. The package name was a typosquat of the legitimate core-js library.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in comander-lib (npm)
comander-lib@1.0.0 is a typosquat of the legitimate `commander` package containing malicious code. The package's postinstall script exfiltrates system information to a C2 server and downloads and executes a Windows payload, with capability to escape WSL/Linux sandboxes via PowerShell.
npmTyposquattingCompromised package