OpenSSF/OSV advisory MAL-2026-12454 confirms this npm version as malicious. On require/import of this package, index.js unconditionally loads _runtime.js, which fetches a platform-selected binary from rotating Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) with a DNS-TXT chunked fallback via *.dl.well1.site, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in statist-browser-typed-client-social.shorts.editor (npm)
Details
On require/import of this package, index.js unconditionally loads _runtime.js, which fetches a platform-selected binary from rotating Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) with a DNS-TXT chunked fallback via *.dl.well1.site, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive identifiers (child_process, chmodSync) are reconstructed at runtime via string-split join and dynamic property assembly to evade static analysis. A secondary module lib/telemetry.js is framed as an analytics SDK but ships the same base64-decode + chmod-0755 + /bin/sh -c spawn dropper capability. The delivery infrastructure is anonymous, mutable, and unrelated to any legitimate publisher; the executed bytes are opaque and attacker-controlled. Installing or loading this package results in arbitrary code execution on the installer's host as a detached background process.
Decision reason
OpenSSF Malicious Packages via OSV confirms statist-browser-typed-client-social.shorts.editor@20.7.1 as malicious (MAL-2026-12454): Malicious code in statist-browser-typed-client-social.shorts.editor (npm)