Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

The npm package statist-browser-typed-client-mb.product.analytics (version 20.1.2) includes a malicious component in its _bridge.js file, which upon require() detects the host platform and downloads a native binary from a set of hardcoded Cloudflare workers.dev endpoints or fallback DNS-TXT records. This binary is saved under a disguised filename in temporary directories, given executable permissions, and spawned detached via system shell commands. The command and control hostnames and payload paths are dynamically assembled at runtime to evade static analysis. No integrity checks such as hash or signature verification are performed on the downloaded binary, enabling full remote code execution on the host machine. The require call is wrapped in a try/catch block that suppresses errors, further hiding malicious activity.

Any system that installs or runs this package is at risk of full host compromise due to remote code execution. Attackers gain complete control over the affected machine, potentially accessing all stored secrets, keys, and sensitive data. The compromise is severe enough that simply removing the package does not guarantee removal of all malicious artifacts or backdoors, necessitating immediate secret rotation and comprehensive incident response.

No official patch or fix is currently available for this malicious package. Immediate removal of the statist-browser-typed-client-mb.product.analytics package version 20.1.2 is strongly recommended. Systems with this package installed should be treated as fully compromised. All secrets and keys stored on affected machines must be rotated from a separate, trusted environment. Conduct a thorough investigation and remediation to identify and remove any additional malware or persistence mechanisms resulting from this compromise.