{"id":"MAL-2026-12449","summary":"Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083)\nOn require() of the package, index.js loads _loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by string-array joins (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a base64-chunked DNS-TXT covert-channel fallback via *.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised filenames (dotnet_diag_\u003crand\u003e.exe,.cache_\u003crand\u003e), chmodded 0o755, and spawned detached via cmd.exe or /bin/sh. Destination hostnames are fragmented across string arrays and joined at runtime to defeat static string matching, and an environment-variable opt-out check is used to evade sandboxes. The package advertises itself as a telemetry exporter but ships a fetch-and-execute dropper reachable on import.\n","modified":"2026-08-05T13:36:02.152324377Z","published":"2026-08-05T12:37:40Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["20.9.3"],"id":"IN-MAL-2026-014734","import_time":"2026-08-05T13:08:41.956984762Z","modified_time":"2026-08-05T12:37:40Z","sha256":"452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/statist-browser-typed-client-mb.reliability.android.metrics/v/20.9.3"}],"affected":[{"package":{"name":"statist-browser-typed-client-mb.reliability.android.metrics","ecosystem":"npm","purl":"pkg:npm/statist-browser-typed-client-mb.reliability.android.metrics"},"versions":["20.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"c0dd84d5760b63a086921f16a358eda877634559d454530603f363f98c1db5fc","tlsh":"e3a184aa15b670194bb0dbe4c6175416f65be66362808598fb9ca5880ff212482f3efc","path":"_loader.js"}],"package_integrity":[{"hashes":{"sha1":"50286e23e196c650204a3034519e75d8f2829231","sha512_sri":"sha512-/0F7yhr7MQLUhOG5YvgL/MTPeTbao9ue+UnKLZCxmCiPm3Ds6HPK+QpxaD5wKsg7A78KPbF5tgIjFB83dboU+A=="},"filename":"statist-browser-typed-client-mb.reliability.android.metrics-20.9.3.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/statist-browser-typed-client-mb.reliability.android.metrics/MAL-2026-12449.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}