OpenSSF/OSV advisory MAL-2026-13379 confirms this npm version as malicious. On require() of this package, index.js loads _compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of three string-obfuscated *.workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), and falls back to a DNS TXT covert channel on *.dl.well1.site (tin/tina/ldr/win.dl.well1.site) if HTTPS fails...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)
Details
On require() of this package, index.js loads _compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of three string-obfuscated *.workers.dev hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), and falls back to a DNS TXT covert channel on *.dl.well1.site (tin/tina/ldr/win.dl.well1.site) if HTTPS fails. The fetched bytes are written to a temp file with a cover-story name (dotnet_diag_*.exe on Windows, /var/tmp/.cache_* on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. C2 hostnames are assembled at runtime from split-string arrays joined with '' to evade static analysis. There is no signature or hash verification, and the fetched binary is unrelated to the package's stated 'web adapter' purpose. A cooldown marker is written to suppress re-execution.
Decision reason
OpenSSF Malicious Packages via OSV confirms statist-browser-typed-client-sme.rko.tariffs.web@20.3.8 as malicious (MAL-2026-13379): Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)