Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)

The npm package statist-browser-typed-client-hra.workplacer.events (version 20.9.1) includes malicious code in its main entry point (_polyfill.js) and a sibling telemetry module. These components download platform-specific binaries from dynamically reconstructed Cloudflare Workers subdomains and fallback DNS TXT-record-resolved domains. The binaries are saved to temporary directories with disguised filenames, permissions are set to executable (chmod 0755), and they are executed detached via shell commands. Host and API names are split and reassembled at runtime to evade static analysis. This behavior results in arbitrary remote code execution on any system that installs or imports this package, effectively compromising the host.

Any computer with this package installed or running is considered fully compromised. The attacker gains arbitrary remote code execution capabilities, potentially allowing full control over the affected system. All secrets and keys stored on the compromised machine are at risk and should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the statist-browser-typed-client-hra.workplacer.events package version 20.9.1 from all affected systems is required. All secrets, keys, and credentials stored on compromised machines should be rotated from a different, trusted system. Due to the nature of the compromise, a full system investigation and potential rebuild is recommended to ensure no persistent malicious components remain. There is no known official patch or fix for this malicious package; remediation relies on removal and secret rotation.