OpenSSF/OSV advisory MAL-2026-12445 confirms this npm version as malicious. index.js unconditionally require()s _bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string concatenation to hide them from static scanners (oob-worker.cf101-*.workers.dev variants, with DNS TXT-record fallback resolution against tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), downloads a platform-specific binary via https.get, writes...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)
Details
index.js unconditionally require()s _bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string concatenation to hide them from static scanners (oob-worker.cf101-*.workers.dev variants, with DNS TXT-record fallback resolution against tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), downloads a platform-specific binary via https.get, writes it to /tmp or the Windows TEMP directory under names mimicking OS internals (dotnet_diag_<hex>.exe,.cache_<hex>), fs.chmodSync 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start. A sibling file lib/telemetry.js (not reachable from the main entry) contains matching dropper primitives — base64 chunk assembly, cp.spawn("/bin/sh",...), fs["chmod"+"Sync"] with parseInt("755",8) — under an analytics-SDK cover story, indicating a staged variant. The require() chain fires as a side effect of importing the package, so any consumer that installs and loads it executes attacker-controlled binaries on the host.
Decision reason
OpenSSF Malicious Packages via OSV confirms statist-browser-typed-client-eventea.projects.pfpacquiring@20.5.8 as malicious (MAL-2026-12445): Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)