MalwarePublished 5 Aug 2026

statist-browser-typed-client-investing.product.loginandauthorization (npm) · Malicious Code

Affects statist-browser-typed-client-investing.product.loginandauthorizationSource GCVE Database

Malicious package : remove statist-browser-typed-client-investing.product.loginandauthorization and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:26 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12210

What to do

Remove statist-browser-typed-client-investing.product.loginandauthorization from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstatist-browser-typed-client-investing.product.loginandauthorization	Affected =20.7.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package statist-browser-typed-client-investing.product.loginandauthorization version 20.7.3 contains malicious code that downloads and executes attacker-controlled native binaries on the host system. This occurs through obfuscated hostnames and runtime-constructed child process calls, resulting in full system compromise upon installation and import of the package. Immediate removal and secret/key rotation are strongly advised.

Impact

Systems with this package installed and imported are fully compromised, allowing execution of arbitrary native code controlled by attackers. This compromises all secrets and keys stored on the affected computer. Removal of the package alone does not guarantee eradication of all malicious software introduced by the attacker.

Defensive guidance

Remove the malicious package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Due to the full system compromise risk, consider rebuilding the affected system to ensure complete remediation. Monitor for any persistence mechanisms or additional malware.

Summary

This threat involves a malicious npm package named statist-browser-typed-client-investing.product.loginandauthorization at version 20.7.3. The package's index.js unconditionally requires a module that selects a per-OS binary URL from obfuscated hostnames, downloads a payload over HTTPS, writes it to temporary directories under decoy filenames, sets executable permissions on POSIX systems, and spawns the binary detached from the main process. The obfuscation includes runtime-joined string arrays and dispersed child_process requires to evade detection. Any system that installs and imports this package executes attacker-controlled native code, resulting in full compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:26 UTC

Technical details

References

Community reviews