MalwarePublished 5 Aug 2026

statist-browser-typed-client-test.jumpwork.circuitbreaker (npm) · Malicious Code

Affects statist-browser-typed-client-test.jumpwork.circuitbreakerSource GCVE Database

Malicious package : remove statist-browser-typed-client-test.jumpwork.circuitbreaker and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:25 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12046

What to do

Remove statist-browser-typed-client-test.jumpwork.circuitbreaker from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstatist-browser-typed-client-test.jumpwork.circuitbreaker	Affected =20.8.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package statist-browser-typed-client-test.jumpwork.circuitbreaker version 20.8.2 contains malicious code that executes attacker-controlled native binaries on the host machine. Upon requiring the package, it downloads and runs native binaries from obfuscated Cloudflare Workers hosts or via a DNS-TXT covert channel, writing files to temporary directories and executing them detached. This behavior indicates intentional evasion and full compromise of any machine installing or running the package. Immediate removal and secret/key rotation are recommended, but full remediation cannot be guaranteed due to potential persistent compromise.

Impact

Any system that installs or runs this package is fully compromised, allowing attackers to execute arbitrary native code with the privileges of the user running the package. This can lead to theft of secrets, keys, and complete system control. Removal of the package alone may not eliminate all malicious artifacts or backdoors, necessitating secret/key rotation and potentially full system remediation.

Defensive guidance

Remove the malicious package immediately. Rotate all secrets and keys stored on the compromised machine from a separate, trusted device. Due to the nature of the compromise, full system remediation may be required as removing the package does not guarantee removal of all malicious components. Monitor for any suspicious activity and consider rebuilding the affected system if possible.

Summary

This malicious npm package version 20.8.2 executes native code on the host by downloading platform-specific binaries from obfuscated Cloudflare Workers domains and executing them with elevated privileges. It uses runtime string reconstruction, writes binaries to temporary directories with decoy filenames, and spawns them detached to evade detection. A DNS-TXT covert channel provides a fallback method for payload delivery. A duplicate dropper is included in the package under lib/telemetry.js. The package's side-effect on require() leads to full system compromise, allowing attackers to control the affected machine.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:25 UTC

Technical details

References

Community reviews