The malicious npm package statist-browser-typed-client-jumptaxi.feature.contacts (version 20.7.7) includes code that, when required, loads a vendor script which selects a platform-specific staging path and downloads a native binary payload from a rotated list of Cloudflare workers.dev domains. These domains are dynamically reconstructed at runtime from split-string arrays, with a fallback mechanism using DNS TXT records to reassemble base64-encoded chunks from numbered subdomains under dl.well1.site. The downloaded binary is saved to temporary directories (/var/tmp or %TEMP%) with misleading filenames such as .cache_<random>, dotnet_diag_<random>.exe, or .analytics_state, given executable permissions (chmod 0755), and then executed detached via shell commands (/bin/sh -c or cmd.exe /c start). No integrity checks like hash or signature verification are performed, and the payload is sourced from infrastructure not affiliated with the legitimate package publisher. This causes automatic execution of attacker-controlled native code on any system that imports this package.

Any system that installs or imports this specific version (20.7.7) of the npm package will automatically execute a native binary controlled by an attacker, potentially leading to full compromise of the host environment. The lack of verification or trusted source for the payload increases the risk of arbitrary code execution, persistence, and further malicious activity. This behavior effectively turns the package into a remote code execution vector triggered by a simple import.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing version 20.7.7 of statist-browser-typed-client-jumptaxi.feature.contacts. Remove the package if already installed and conduct a thorough investigation of the host for signs of compromise. Monitor for updates from the package publisher or npm security advisories for any forthcoming fixes. Since no vendor advisory or patch information is available, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.