{"id":"MAL-2026-12158","summary":"Malicious code in bigops-chats-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eb764a83c5f69d414a640397df2acd34a25e83c8829a63040046661fd4e33a69)\nOn require() of the package, index.js loads _init.js which performs OS/arch detection, downloads a native binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a temp path with a masqueraded filename (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. C2 hostnames are assembled at runtime from arrays of substrings joined together to evade static string search. If HTTPS retrieval fails, _init.js falls back to a DNS-TXT covert channel under *.dl.wel1.ru sub-zones (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru): it resolves c.\u003cdomain\u003e to obtain a chunk count, resolves \u003ci\u003e.\u003cdomain\u003e for each chunk, base64-decodes the concatenated payload, writes it to disk and executes it. A cache flag (.analytics_state) is used to run once per TTL. The package advertises itself as a chats client SDK; there is no legitimate reason for such a package to fetch and execute an opaque native binary at load time.\n","modified":"2026-08-05T10:05:56.701877910Z","published":"2026-08-05T08:44:08Z","database_specific":{"malicious-packages-origins":[{"versions":["35.2.4"],"id":"IN-MAL-2026-014395","import_time":"2026-08-05T09:28:06.000343081Z","modified_time":"2026-08-05T08:44:08Z","sha256":"eb764a83c5f69d414a640397df2acd34a25e83c8829a63040046661fd4e33a69","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-chats-client/v/35.2.4"}],"affected":[{"package":{"name":"bigops-chats-client","ecosystem":"npm","purl":"pkg:npm/bigops-chats-client"},"versions":["35.2.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-chats-client/MAL-2026-12158.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"823f0880ed51ee7b1d793e9524e0d54bc042a43776532f4f262ba00ef1d83519","tlsh":"27a1975a12aa71198bb0ebe5c6174416f65bf6633280c5c4fbac69844f73124c3b2dfc","path":"_init.js"}],"package_integrity":[{"filename":"bigops-chats-client-35.2.4.tgz","hashes":{"sha1":"dd9026da276d9cf634d668115be6e0542b1c7ab4","sha512_sri":"sha512-iMd3wN2skR+2bQELQsjFaL92f5NowdRgd58xGOYv3jZcrv1i6NxUZK8FPJuhDF7FHznBG0bj0+WtnSb8I3i0jw=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}