statist-browser-typed-client-mb.product.mclaccount @20.2.6
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12447
Ecosystem
npm
Summary
On require, index.js loads _loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints (oob-worker.cf102-baf.workers.dev, cf100-416/cf103-070/cf99-9b3.workers.dev) with a DNS TXT-record fallback channel across numbered subdomains of dl.well1.site (tin, tina, ldr, win) that reassembles a base64 payload. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames and API names are reconstructed via split-string joins (e.g. ['tin.','dl.well1.si','te'].join(''), require('child_'+'process')) to evade static analysis. A parallel implementation of the same dropper is shipped as lib/telemetry.js under an 'analytics SDK' cover story, with identical DNS-TXT reassembly, chmod 0755, and detached /bin/sh execution.
Source: amazon-inspector (1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.