statist-browser-typed-client-risktech.uwfrontantifraud.events @20.1.5
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12450
Ecosystem
npm
Summary
On require / import , _compat.js (reached from index.js ) downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains ( oob-worker.cf100-416.workers.dev , oob-worker.cf101-adf.workers.dev , oob-worker.cf103-070.workers.dev ) with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered subdomains under well1.site ( c.<domain> , tin.dl.well1.site , tina.dl.well1.site , ldr.dl.well1.site , win.dl.well1.site ). The fetched bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows under disguised cache/diagnostic names, chmod +x'd, and spawned detached via /bin/sh -c '<path> &' or cmd . The C2 hostnames are constructed by joining split string fragments to evade static analysis. A cooldown flag file ( /tmp/.analytics_state or %TEMP%/analytics_state ) suppresses re-execution for ~22046 seconds, and execution is gated on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars as a telemetry cover story. The destinations are anonymous Cloudflare Workers subdomains and a lookalike DDNS-style domain unrelated to any legitimate publisher; no integrity verification is performed on the downloaded binary.
Source: amazon-inspector (4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.