Threats Tagged 'mal-2026-12449'

The npm package statist-browser-typed-client-mb.reliability.android.metrics version 20.9.3 contains malicious code that acts as a fetch-and-execute dropper. Upon import, it loads a loader script that downloads a platform-specific binary from obfuscated Cloudflare Workers hosts, using string-array joins to evade static detection. It also uses a base64-chunked DNS-TXT covert channel as a fallback. The binary is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the parent process. An environment variable opt-out mechanism is present to evade sandbox detection. The package masquerades as a telemetry exporter but performs unauthorized code execution.