Skip to main content

Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

0
Critical
Published: 08/05/2026 (08/05/2026, 12:36:57 UTC)
Source: GCVE Database
Product: statist-browser-typed-client-rubliq.platform.keycloak

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf) The package presents itself as a Keycloak typed client but on require() executes a binary dropper. index.js loads _adapter.js, which reconstructs destination hostnames from split string fragments joined via.join('') to hide them from static analysis, selects a platform-specific URL, and downloads a binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev). The downloaded bytes are written to /tmp or the Windows Temp directory under disguised names (.analytics_state, dotnet_diag_*.exe,.cache_*), chmodded to 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start. A DNS-TXT covert-channel fallback under subdomains of dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) reassembles a base64-encoded binary from TXT record chunks when HTTPS fetch fails, feeding the same write+chmod+spawn chain. The child_process module name is constructed as require('child_' + 'process') and chmodSync is accessed as fs['chmod'+'Sync'] to further evade pattern matching. Environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked to give the behavior a telemetry cover story. lib/telemetry.js contains a parallel dropper implementation with the same primitives, wrapped in 'Analytics SDK' comments. The package name resembles a legitimate Keycloak client but the shipped code performs installer-side arbitrary code execution rather than any Keycloak functionality. ## Source: ghsa-malware (d96ef446f7a474a7855c2746501c889834693353fd5d40db11171180af0ead0a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Affected software

npmghsa
statist-browser-typed-client-rubliq.platform.keycloak
Affected versions
=20.2.5

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 08/05/2026, 17:33:21 UTC

Technical Analysis

This malicious npm package named statist-browser-typed-client-rubliq.platform.keycloak executes a binary dropper when loaded. The dropper reconstructs obfuscated destination hostnames to download binaries over HTTPS from Cloudflare Workers hosts. If HTTPS fetching fails, it uses a DNS-TXT record covert channel to reassemble a base64-encoded binary from TXT record chunks. The downloaded binaries are written to temporary directories under disguised filenames, permissions are set to executable, and the binaries are spawned detached using platform-specific shell commands. The code employs evasion techniques such as dynamic string concatenation to hide module and function names from static analysis. Environment variables related to telemetry are checked to provide a cover story for its behavior. The package does not implement any legitimate Keycloak client functionality but instead performs arbitrary code execution on the installer system.

Potential Impact

The package enables arbitrary code execution on the system where it is installed by dropping and running binaries without user consent. This can lead to full system compromise, persistence, and potentially further malicious activities depending on the payload. The malicious behavior is triggered simply by requiring the package, posing a high risk to any project that installs or uses this package.

Mitigation Recommendations

No official patch or remediation is currently documented. Users should avoid installing or using the statist-browser-typed-client-rubliq.platform.keycloak package, especially version =20.2.5. Remove any instances of this package from projects and dependency trees. Conduct audits of npm dependencies to detect and exclude this malicious package. Monitor for any updates or advisories from npm or security vendors regarding this package for potential remediation.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
MAL-2026-12451
Osv Schema Version
1.7.4
Ecosystems
["npm"]

Threat ID: 6a735746bf8831d53915a05c

Added to database: 08/05/2026, 15:31:18 UTC

Last enriched: 08/05/2026, 17:33:21 UTC

Last updated: 09/07/2026, 22:29:17 UTC

Views: 26

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses