This threat involves the npm package statist-browser-typed-client-mb.reliability.android.metrics version 20.9.3, which contains malicious functionality embedded in its index.js and _loader.js files. The loader downloads a platform-specific binary from hardcoded Cloudflare Workers URLs constructed at runtime to evade static analysis. If that fails, it uses a covert DNS-TXT channel to retrieve the payload. The payload is written to temporary directories under disguised filenames, permissioned as executable, and launched detached via system shell commands (cmd.exe or /bin/sh). The package includes an environment variable check to avoid execution in sandbox environments. This behavior indicates a fetch-and-execute dropper hidden within a seemingly legitimate telemetry exporter package.

The malicious package enables arbitrary code execution on the host system by downloading and running a binary without user consent. This can lead to unauthorized system compromise, persistence, and potential further payload delivery. The obfuscation techniques and sandbox evasion increase the difficulty of detection and analysis. No known exploits in the wild have been reported yet, but the presence of a dropper in a widely used package repository poses a significant risk to users who install this specific version.

No official patch or remediation is currently documented for this package version. Users should avoid installing or using statist-browser-typed-client-mb.reliability.android.metrics version 20.9.3. If already installed, remove the package and scan affected systems for any dropped binaries or suspicious processes. Monitor for environment variables that might disable sandbox evasion and consider restricting execution of binaries from temporary directories. Check the package source and vendor advisories regularly for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.