MAL-2026-12151
Dashboard / Malicious Package / MAL-2026-12151
MAL-2026-12151
Summary: Malicious code in bigops-auth-interceptor (npm)
Details: Source: amazon-inspector (018aa5e99b7e6aa9f438b51ee00164801a2eb1c52e78ad123d0c490dced4b67c) On require() of [email protected], index.js loads _vendor.js which selects a platform-specific binary URL, downloads bytes over HTTPS from one of four string-concatenation-obfuscated Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), writes them to a temp path under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Linux), chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe. A DNS TXT-record fallback channel (c.<domain> returns a chunk count, then i.<domain> TXT records are concatenated and base64-decoded into the payload) is implemented against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, providing covert payload retrieval when HTTPS is blocked. A run-once marker file (.analytics_state) prevents repeated execution. Destination hosts are unrelated to any legitimate publisher of the package's stated purpose; the fetched bytes are unpinned, unsigned, and platform-selected.
Affected packages
Package
Name: bigops-auth-interceptor
Purl: pkg:npm/bigops-auth-interceptor
Affected ranges
Type: N/A
Events:
