OpenSSF/OSV advisory MAL-2026-12443 confirms this npm version as malicious. On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via `.join('')` from split string fragments (e.g. ['oob-worker.cf100-416.w','ork','er','s.de','v'].join('')), downloads an opaque native binary via https.get, writes it to a temp path under a cover-story name (`dotnet_diag_<hex>.exe` / `.cache_<hex>`), chmods it 0755, and...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)
Details
On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via `.join('')` from split string fragments (e.g. ['oob-worker.cf100-416.w','ork','er','s.de','v'].join('')), downloads an opaque native binary via https.get, writes it to a temp path under a cover-story name (`dotnet_diag_<hex>.exe` / `.cache_<hex>`), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true})` (or `spawn('cmd',...)` on Windows). If HTTPS retrieval fails, the loader falls back to a DNS-TXT covert channel: `dns.resolveTxt` is called against `tin.dl.well1.site`, `tina.dl.well1.site`, `ldr.dl.well1.site`, `win.dl.well1.site` (also assembled from split fragments), and the TXT record contents are concatenated and base64-decoded to reconstruct the payload bytes. A `checkStamp()` flag file gates re-execution and stderr writes are used as silent no-op logs. The fetched binary is unpinned, unsigned, and unrelated to the package's advertised SDK purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms statist-browser-typed-client-automlplatform.nlppl.searchy@20.2.2 as malicious (MAL-2026-12443): Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)