Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf) The package presents itself as a Keycloak typed client but on require() executes a binary dropper. index.js loads _adapter.js, which reconstructs destination hostnames from split string fragments joined via.join('') to hide them from static analysis, selects a platform-specific URL, and downloads a binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev). The downloaded bytes are written to /tmp or the Windows Temp directory under disguised names (.analytics_state, dotnet_diag_*.exe,.cache_*), chmodded to 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start. A DNS-TXT covert-channel fallback under subdomains of dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) reassembles a base64-encoded binary from TXT record chunks when HTTPS fetch fails, feeding the same write+chmod+spawn chain. The child_process module name is constructed as require('child_' + 'process') and chmodSync is accessed as fs['chmod'+'Sync'] to further evade pattern matching. Environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked to give the behavior a telemetry cover story. lib/telemetry.js contains a parallel dropper implementation with the same primitives, wrapped in 'Analytics SDK' comments. The package name resembles a legitimate Keycloak client but the shipped code performs installer-side arbitrary code execution rather than any Keycloak functionality. ## Source: ghsa-malware (d96ef446f7a474a7855c2746501c889834693353fd5d40db11171180af0ead0a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
This malicious npm package named statist-browser-typed-client-rubliq.platform.keycloak executes a binary dropper when loaded. The dropper reconstructs obfuscated destination hostnames to download binaries over HTTPS from Cloudflare Workers hosts. If HTTPS fetching fails, it uses a DNS-TXT record covert channel to reassemble a base64-encoded binary from TXT record chunks. The downloaded binaries are written to temporary directories under disguised filenames, permissions are set to executable, and the binaries are spawned detached using platform-specific shell commands. The code employs evasion techniques such as dynamic string concatenation to hide module and function names from static analysis. Environment variables related to telemetry are checked to provide a cover story for its behavior. The package does not implement any legitimate Keycloak client functionality but instead performs arbitrary code execution on the installer system.
Potential Impact
The package enables arbitrary code execution on the system where it is installed by dropping and running binaries without user consent. This can lead to full system compromise, persistence, and potentially further malicious activities depending on the payload. The malicious behavior is triggered simply by requiring the package, posing a high risk to any project that installs or uses this package.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using the statist-browser-typed-client-rubliq.platform.keycloak package, especially version =20.2.5. Remove any instances of this package from projects and dependency trees. Conduct audits of npm dependencies to detect and exclude this malicious package. Monitor for any updates or advisories from npm or security vendors regarding this package for potential remediation.
Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf) The package presents itself as a Keycloak typed client but on require() executes a binary dropper. index.js loads _adapter.js, which reconstructs destination hostnames from split string fragments joined via.join('') to hide them from static analysis, selects a platform-specific URL, and downloads a binary over HTTPS from Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev). The downloaded bytes are written to /tmp or the Windows Temp directory under disguised names (.analytics_state, dotnet_diag_*.exe,.cache_*), chmodded to 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start. A DNS-TXT covert-channel fallback under subdomains of dl.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) reassembles a base64-encoded binary from TXT record chunks when HTTPS fetch fails, feeding the same write+chmod+spawn chain. The child_process module name is constructed as require('child_' + 'process') and chmodSync is accessed as fs['chmod'+'Sync'] to further evade pattern matching. Environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked to give the behavior a telemetry cover story. lib/telemetry.js contains a parallel dropper implementation with the same primitives, wrapped in 'Analytics SDK' comments. The package name resembles a legitimate Keycloak client but the shipped code performs installer-side arbitrary code execution rather than any Keycloak functionality. ## Source: ghsa-malware (d96ef446f7a474a7855c2746501c889834693353fd5d40db11171180af0ead0a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This malicious npm package named statist-browser-typed-client-rubliq.platform.keycloak executes a binary dropper when loaded. The dropper reconstructs obfuscated destination hostnames to download binaries over HTTPS from Cloudflare Workers hosts. If HTTPS fetching fails, it uses a DNS-TXT record covert channel to reassemble a base64-encoded binary from TXT record chunks. The downloaded binaries are written to temporary directories under disguised filenames, permissions are set to executable, and the binaries are spawned detached using platform-specific shell commands. The code employs evasion techniques such as dynamic string concatenation to hide module and function names from static analysis. Environment variables related to telemetry are checked to provide a cover story for its behavior. The package does not implement any legitimate Keycloak client functionality but instead performs arbitrary code execution on the installer system.
Potential Impact
The package enables arbitrary code execution on the system where it is installed by dropping and running binaries without user consent. This can lead to full system compromise, persistence, and potentially further malicious activities depending on the payload. The malicious behavior is triggered simply by requiring the package, posing a high risk to any project that installs or uses this package.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or using the statist-browser-typed-client-rubliq.platform.keycloak package, especially version =20.2.5. Remove any instances of this package from projects and dependency trees. Conduct audits of npm dependencies to detect and exclude this malicious package. Monitor for any updates or advisories from npm or security vendors regarding this package for potential remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12451
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735746bf8831d53915a05c
Added to database: 08/05/2026, 15:31:18 UTC
Last enriched: 08/05/2026, 17:33:21 UTC
Last updated: 09/07/2026, 22:29:17 UTC
Views: 26
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.