This threat involves a malicious npm package, statist-browser-typed-client-mb.product.sme.cards version 20.5.9, which upon being required, loads a secondary script (_ext.js) that downloads platform-specific executables from obfuscated Cloudflare Workers hosts and fallback domains using DNS-TXT base64 fallback mechanisms. The downloaded binaries are saved under disguised filenames in temporary directories, permissions are set to executable on POSIX systems, and the binaries are spawned detached via shell commands. The package constructs hostnames and API names at runtime through string concatenation to evade static analysis. The malicious behavior is disguised as telemetry or analytics. According to the source, any computer with this package installed should be considered fully compromised, necessitating immediate rotation of all secrets and keys from a different machine. Removal of the package does not guarantee removal of all malicious software resulting from its installation.

Systems with this package installed or running are considered fully compromised, potentially allowing attackers full control over the affected computer. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. The malicious package downloads and executes arbitrary binaries, which may lead to persistent backdoors or further malware installation. Simply removing the package may not remove all malicious components due to the extent of the compromise.

Immediate removal of the statist-browser-typed-client-mb.product.sme.cards package version 20.5.9 is recommended. However, because the system is considered fully compromised, all secrets and keys stored on the affected computer must be rotated immediately from a different, secure machine. Additional forensic analysis and system remediation may be necessary to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.