OpenSSF/OSV advisory MAL-2026-12453 confirms this npm version as malicious. On require() of the package, _support.js assembles remote hostnames from split-string array joins (e.g. ["oob-wo","rker.cf1","02-baf.workers.","dev"].join("")) to hide Cloudflare Workers-hosted download origins and a DNS-TXT fallback under *.dl.well1.site. It selects a platform-specific path, downloads an opaque native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)
Details
On require() of the package, _support.js assembles remote hostnames from split-string array joins (e.g. ["oob-wo","rker.cf1","02-baf.workers.","dev"].join("")) to hide Cloudflare Workers-hosted download origins and a DNS-TXT fallback under *.dl.well1.site. It selects a platform-specific path, downloads an opaque native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmods it 0o755 on POSIX, and spawns it detached (detached:true, stdio:"ignore",.unref()) via /bin/sh -c or cmd.exe /c start /b. A marker file.analytics_state throttles re-download to ~6.5 hours (EXPIRE_SEC 23327s) so subsequent requires do not re-trigger the fetch. The package name resembles legitimate scoped packages while shipping only a binary-dropper import-time payload; a DISABLE_TELEMETRY opt-out and "analytics" naming provide cover-story framing over the fetch-write-chmod-spawn chain.
Decision reason
OpenSSF Malicious Packages via OSV confirms statist-browser-typed-client-sme.rko.finance.web@20.7.7 as malicious (MAL-2026-12453): Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)