{"id":"MAL-2026-12150","summary":"Malicious code in bigops-auth-cache (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542)\nOn require('bigops-auth-cache'), index.js loads _compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) and *.dl.wel1.ru domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to a temp file with a disguised name (dotnet_diag_*.exe /.cache_*), chmods 0755, and spawns it detached via cmd.exe or /bin/sh (_compat.js line 124-130). Hostnames are assembled at runtime from split-string arrays (['sdk.dl.w','el1','.ru'].join('')) to evade static detection. A DNS TXT-record covert channel serves as fallback payload delivery: a count record at c.\u003cdomain\u003e and chunked base64 payload at N.\u003cdomain\u003e are reassembled and executed. No hash or signature verification. Cover-story comments describe the code as 'analytics' / 'telemetry' / 'session management', contradicting the observed dropper behavior.\n","modified":"2026-08-05T10:05:52.582034288Z","published":"2026-08-05T08:46:38Z","database_specific":{"malicious-packages-origins":[{"versions":["35.3.9"],"id":"IN-MAL-2026-014412","import_time":"2026-08-05T09:28:08.241070406Z","modified_time":"2026-08-05T08:46:38Z","sha256":"f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-auth-cache/v/35.3.9"}],"affected":[{"package":{"name":"bigops-auth-cache","ecosystem":"npm","purl":"pkg:npm/bigops-auth-cache"},"versions":["35.3.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-auth-cache/MAL-2026-12150.json","indicators":{"package_integrity":[{"filename":"bigops-auth-cache-35.3.9.tgz","hashes":{"sha1":"bab45902cef9fcba32e9f849bcebfa0d0d8c286a","sha512_sri":"sha512-KCMkCE0Ub5NxyQxQfSrruA1Q5IppWdiktMT66QtGFwc1YYtdUlYhgwY53bsaSM8LVKm+EaMB3/u/xr0oABZONg=="}}],"evidence_files":[{"path":"_compat.js","sha256":"c55fb34e1a3eb00a9835a2aa0889fd4798b26de2a71fefebbda49eed6c980183","tlsh":"5db195a6129a70188bb0e7e0c71b5816f65bf66337c182d4f79c95984f7252483b2efc"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}