{"id":"MAL-2026-11535","summary":"Malicious code in bigops-backend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41)\nOn require(), _adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames (assembled at runtime by joining string fragments such as [\"oob-worker.cf100-416.w\",\"orke\",\"rs.\",\"dev\"]), downloads an opaque binary over HTTPS with no version pin and no hash verification, writes it to /var/tmp/.cache_\u003crand\u003e or %TEMP%\\dotnet_diag_\u003crand\u003e.exe under a cover-story name, chmods it 0755, and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp + \" &\"], {detached:true, stdio:\"ignore\"}).unref(). A DNS TXT-record fallback channel reassembles a base64 payload from numbered subdomains under *.dl.wel1.ru (hostname also constructed by split-and-join at runtime) when HTTPS is blocked. lib/telemetry.js in the same tarball contains the same dropper shape (cp.spawn to /bin/sh, chmodSync 0755, base64 reassembly from DNS chunks) behind an \"Analytics SDK\" cover story. The runtime hostname reconstruction, the DNS-TXT covert channel, the disguised staging paths, and the detached background execution grant arbitrary remote code execution on any host that installs or requires this package.\n","modified":"2026-08-04T23:04:52.550899809Z","published":"2026-08-04T22:08:25Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-04T22:30:11.995488966Z","modified_time":"2026-08-04T22:08:25Z","sha256":"4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41","source":"amazon-inspector","versions":["35.8.3"],"id":"IN-MAL-2026-011347"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-backend/v/35.8.3"}],"affected":[{"package":{"name":"bigops-backend","ecosystem":"npm","purl":"pkg:npm/bigops-backend"},"versions":["35.8.3"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"f9a1759a166a70184bb0e7f486174416f65be6a33380c6d4fb5c69985fb312482b2efc","path":"_adapter.js","sha256":"f901c6116eb181294f7439b1dadcc749547d356c0ecb812dc2c93a7a12ac0f97"},{"tlsh":"fc835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"1131f4d315b2f94c3917294cde8ba079566c0e2dba4dfb0662113df291bfceb2"}],"package_integrity":[{"filename":"bigops-backend-35.8.3.tgz","hashes":{"sha1":"8effb8bcfdbc544327c18712e89d524b692f64f5","sha512_sri":"sha512-KGySyA6Exdj1fRywNVoe2zpjrcxnfDieug69Au0HP4W+xVIcEgJ7sxE0/AVsUSQDKgyu/sY5Iqby/dcT0rzzxg=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-backend/MAL-2026-11535.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}