MAL-2026-12157

    Dashboard / Malicious Package / MAL-2026-12157

    MAL-2026-12157

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bigops-chats (npm)

    Details: Source: amazon-inspector (322310cb37baed38193c12087a25e40901a781467fc070c1bf078293ca8586be) On require() of bigops-chats, index.js loads _helpers.js which assembles C2 hostnames via array split-join obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT fallback under sdk.dl.wel1.ru), fetches a platform-specific binary from those hosts without hash or signature verification, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored. A stamp file at /tmp/.analytics_state suppresses re-runs. The staged filename mimics dotnet diagnostic tooling and the behavior is framed as analytics with an env-var opt-out. Hostnames are not publisher-controlled infrastructure and the delivered bytes are opaque and unverifiable.

    References: https://www.npmjs.com/package/bigops-chats/v/35.9.6

    Affected packages

    Package

    Name: bigops-chats

    Purl: pkg:npm/bigops-chats

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.6