MalwarePublished 5 Aug 2026

statist-browser-typed-client-sme.rko.tariffs.web (npm) · Malicious Code

Affects statist-browser-typed-client-sme.rko.tariffs.webSource GCVE Database

Malicious package : remove statist-browser-typed-client-sme.rko.tariffs.web and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:25 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13379

What to do

Remove statist-browser-typed-client-sme.rko.tariffs.web from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstatist-browser-typed-client-sme.rko.tariffs.web	Affected =20.3.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package statist-browser-typed-client-sme.rko.tariffs.web version 20.3.8 contains malicious code that, upon require(), downloads and executes a platform-specific binary payload from obfuscated command and control servers. The payload is saved with deceptive filenames and executed detached from the parent process. The package uses fallback covert DNS TXT channels if HTTPS fetching fails. There is no integrity verification of the downloaded binary. Systems with this package installed should be considered fully compromised.

Impact

Any system with this package installed or running is considered fully compromised, as the package downloads and executes arbitrary binaries from attacker-controlled servers without verification. This can lead to complete loss of control over the affected system and potential exposure of all stored secrets and keys.

Defensive guidance

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted machine. Because the package grants full control to an attacker, removing the package alone may not fully remediate the compromise; a full system investigation and potential rebuild is recommended.

Summary

This malicious npm package, version 20.3.8, executes code that loads a platform-specific payload by fetching an opaque binary over HTTPS from obfuscated *.workers.dev hosts, with a fallback to a DNS TXT covert channel if HTTPS fails. The binary is saved to temporary locations with cover-story names and executed with elevated permissions. The command and control hostnames are dynamically assembled to evade static detection. No signature or hash verification is performed on the downloaded payload, which is unrelated to the package's stated purpose. The presence of this package indicates a full system compromise, requiring immediate secret/key rotation and package removal.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:25 UTC

Technical details

References

Community reviews