This threat involves a malicious npm package (statist-browser-typed-client-jumptaxi.feature.contacts, version 20.7.7) that, when imported, triggers execution of attacker-controlled native code. The package's _vendor.js script dynamically constructs platform-specific URLs from split-string arrays to download a binary payload from a rotating list of Cloudflare workers.dev origins. If that fails, it uses a DNS TXT record covert channel to reassemble base64-encoded chunks from numbered subdomains under dl.well1.site. The downloaded binary is saved to temporary directories with misleading filenames, permissions are set to executable (chmod 0755), and it is launched detached via shell commands (/bin/sh -c or cmd.exe /c start). No integrity checks such as hash or signature verification are performed, and the download sources are not affiliated with the package publisher, enabling arbitrary code execution on the host.

Any user or system that imports this specific npm package version will automatically execute attacker-controlled native code on their machine. This can lead to full compromise of the host environment, unauthorized access, data theft, or further malware deployment. The lack of integrity verification and use of covert channels for payload delivery increases the stealth and risk of exploitation.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing version 20.7.7 of statist-browser-typed-client-jumptaxi.feature.contacts. Remove the package if already installed and scan affected systems for signs of compromise. Monitor vendor advisories for updates or fixes. Since this is not a cloud service, remediation depends on user action.