MAL-2026-12213 Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback via tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe), chmod 0755 is applied on POSIX, and the binary is spawned detached via /bin/sh -c or cmd /c start /b. Host arrays and API names are constructed at runtime by joining split fragments (e.g. require("child_"+"process"), fs["chmod"+"Sync"]) to defeat static string scanning, and comments frame the behavior as telemetry/analytics.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.