MAL-2026-12449

Dashboard / Malicious Package / MAL-2026-12449

MAL-2026-12449

Summary: Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)

Details: Source: amazon-inspector (452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083) On require() of the package, index.js loads _loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by string-array joins (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a base64-chunked DNS-TXT covert-channel fallback via *.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised filenames (dotnet_diag_<rand>.exe,.cache_<rand>), chmodded 0o755, and spawned detached via cmd.exe or /bin/sh. Destination hostnames are fragmented across string arrays and joined at runtime to defeat static string matching, and an environment-variable opt-out check is used to evade sandboxes. The package advertises itself as a telemetry exporter but ships a fetch-and-execute dropper reachable on import.

References: https://www.npmjs.com/package/statist-browser-typed-client-mb.reliability.android.metrics/v/20.9.3