statist-browser-typed-client-mb.reliability.android.metrics

{"modified":"2026-08-05T12:37:40Z","published":"2026-08-05T12:37:40Z","schema_version":"1.7.4","id":"MAL-2026-12449","summary":"Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083)\nOn require() of the package, index.js loads _loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by string-array joins (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a base64-chunked DNS-TXT covert-channel fallback via *.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised filenames (dotnet_diag_<rand>.exe,.cache_<rand>), chmodded 0o755, and spawned detached via cmd.exe or /bin/sh. Destination hostnames are fragmented across string arrays and joined at runtime to defeat static string matching, and an environment-variable opt-out check is used to evade sandboxes. The package advertises itself as a telemetry exporter but ships a fetch-and-execute dropper reachable on import.\n","affected":[{"package":{"ecosystem":"npm","name":"statist-browser-typed-client-mb.reliability.android.metrics"},"versions":["20.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"c0dd84d5760b63a086921f16a358eda877634559d454530603f363f98c1db5fc","tlsh":"e3a184aa15b670194bb0dbe4c6175416f65be66362808598fb9ca5880ff212482f3efc"}],"package_integrity":[{"filename":"statist-browser-typed-client-mb.reliability.android.metrics-20.9.3.tgz","hashes":{"sha1":"50286e23e196c650204a3034519e75d8f2829231","sha512_sri":"sha512-/0F7yhr7MQLUhOG5YvgL/MTPeTbao9ue+UnKLZCxmCiPm3Ds6HPK+QpxaD5wKsg7A78KPbF5tgIjFB83dboU+A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/statist-browser-typed-client-mb.reliability.android.metrics/v/20.9.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014734","import_time":"2026-08-05T13:08:41.956984762Z","modified_time":"2026-08-05T12:37:40Z","sha256":"452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083","source":"amazon-inspector","versions":["20.9.3"]}]}}