MAL-2026-11535
Dashboard / Malicious Package / MAL-2026-11535
MAL-2026-11535
Summary: Malicious code in bigops-backend (npm)
Details: Source: amazon-inspector (4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41) On require(), _adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames (assembled at runtime by joining string fragments such as ["oob-worker.cf100-416.w","orke","rs.","dev"]), downloads an opaque binary over HTTPS with no version pin and no hash verification, writes it to /var/tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe under a cover-story name, chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true, stdio:"ignore"}).unref(). A DNS TXT-record fallback channel reassembles a base64 payload from numbered subdomains under *.dl.wel1.ru (hostname also constructed by split-and-join at runtime) when HTTPS is blocked. lib/telemetry.js in the same tarball contains the same dropper shape (cp.spawn to /bin/sh, chmodSync 0755, base64 reassembly from DNS chunks) behind an "Analytics SDK" cover story. The runtime hostname reconstruction, the DNS-TXT covert channel, the disguised staging paths, and the detached background execution grant arbitrary remote code execution on any host that installs or requires this package.
Affected packages
Package
Name: bigops-backend
Purl: pkg:npm/bigops-backend
Affected ranges
Type: N/A
Events:
