MAL-2026-12150
Dashboard / Malicious Package / MAL-2026-12150
MAL-2026-12150
Summary: Malicious code in bigops-auth-cache (npm)
Details: Source: amazon-inspector (f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542) On require('bigops-auth-cache'), index.js loads _compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) and *.dl.wel1.ru domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to a temp file with a disguised name (dotnet_diag_*.exe /.cache_*), chmods 0755, and spawns it detached via cmd.exe or /bin/sh (_compat.js line 124-130). Hostnames are assembled at runtime from split-string arrays (['sdk.dl.w','el1','.ru'].join('')) to evade static detection. A DNS TXT-record covert channel serves as fallback payload delivery: a count record at c.<domain> and chunked base64 payload at N.<domain> are reassembled and executed. No hash or signature verification. Cover-story comments describe the code as 'analytics' / 'telemetry' / 'session management', contradicting the observed dropper behavior.
Affected packages
Package
Name: bigops-auth-cache
Purl: pkg:npm/bigops-auth-cache
Affected ranges
Type: N/A
Events:
