This threat involves a malicious npm package that, upon being required or imported, executes a script (_compat.js) which downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains. It uses a DNS-TXT covert channel fallback to reconstruct a base64 payload from multiple subdomains under a lookalike DDNS domain. The binary is saved to temporary directories with disguised cache or diagnostic filenames, made executable, and executed detached from the main process. The malware uses a cooldown flag file to limit re-execution and checks environment variables related to telemetry to disguise its activity. The command and control infrastructure uses obfuscated hostnames to evade static analysis, and no integrity verification is performed on the downloaded binary, increasing risk.

The malicious package can execute arbitrary platform-specific code on the host system without integrity verification, potentially leading to unauthorized code execution and system compromise. The use of obfuscated C2 domains and telemetry environment variable checks suggests attempts to evade detection and analysis. The downloaded executable runs detached, making it harder to trace. This poses a significant risk to systems that install or use this package version.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing or using version 20.1.5 of statist-browser-typed-client-risktech.uwfrontantifraud.events. Remove the package if already installed and scan affected systems for the presence of the downloaded binaries and related artifacts such as /tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe. Monitor for suspicious processes spawned from these locations. Since no integrity verification is performed, block network access to the identified Cloudflare Workers subdomains and the well1.site domain to prevent payload retrieval. Consider using trusted package sources and verify package integrity before use.