MAL-2026-12449 Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)

On require() of the package, index.js loads loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by string-array joins (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a base64-chunked DNS-TXT covert-channel fallback via *.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under disguised filenames (dotnet_diag<rand>.exe,.cache_<rand>), chmodded 0o755, and spawned detached via cmd.exe or /bin/sh. Destination hostnames are fragmented across string arrays and joined at runtime to defeat static string matching, and an environment-variable opt-out check is used to evade sandboxes. The package advertises itself as a telemetry exporter but ships a fetch-and-execute dropper reachable on import.