{"id":"MAL-2026-13220","summary":"Malicious code in bigops-jsonpath-mapper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (784552abf30d07bd647e0c3844dc45ea0205cf20c166ca1e38ef924c5fd999b7)\nOn require of bigops-jsonpath-mapper, index.js loads _bridge.js which assembles hostnames from string-array joins to hide the destinations (oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev, with DNS-TXT chunked-base64 fallback to *.dl.wel1.ru), fetches a platform-specific native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names such as.cache_\u003chex\u003e and dotnet_diag_\u003chex\u003e.exe, chmods 0755 on Unix, and spawns it detached and unref'd via spawn(\"/bin/sh\",...) or spawn(\"cmd\",...). A /tmp/.analytics_state TTL file suppresses re-execution across imports. Comments frame the behavior as telemetry/session tracking, but the shipped code is a fetch-and-execute dropper of opaque bytes from author-controlled non-publisher infrastructure that runs at module load time.\n","modified":"2026-08-05T16:49:58.381348506Z","published":"2026-08-05T15:38:20Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015775","import_time":"2026-08-05T16:13:43.964777823Z","modified_time":"2026-08-05T15:38:20Z","sha256":"784552abf30d07bd647e0c3844dc45ea0205cf20c166ca1e38ef924c5fd999b7","source":"amazon-inspector","versions":["35.4.6"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-jsonpath-mapper/v/35.4.6"}],"affected":[{"package":{"name":"bigops-jsonpath-mapper","ecosystem":"npm","purl":"pkg:npm/bigops-jsonpath-mapper"},"versions":["35.4.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-jsonpath-mapper/MAL-2026-13220.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"6f6322308a1ff80592f0222746bd9c6406fc6b29f40388d6d6221a6e5ab9941e","tlsh":"b4a1879a11a570194f70e7e0c61b8826f66bf663368192c4fb9c59845fb362483b1efc"}],"package_integrity":[{"filename":"bigops-jsonpath-mapper-35.4.6.tgz","hashes":{"sha1":"ea5e7b987efcf34cd9183c53a0af532775433248","sha512_sri":"sha512-RU6eHHW5cMpNo6Uerj4vLWbeeSfbq+GNAd3GIM1KoYcxdLCPSVhrKjBQi7ggyaidcLhtHeMl6w9lsinRxY423Q=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}