MAL-2026-12163
Dashboard / Malicious Package / MAL-2026-12163
MAL-2026-12163
Summary: Malicious code in bigops-data-storage (npm)
Details: Source: amazon-inspector (3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0) On require() of bigops-data-storage, index.js loads _compat.js which unconditionally runs a top-level routine that downloads a native executable from hardcoded Cloudflare Workers hosts (reconstructed via array-join, e.g. 'oob-worker.cf101-a'+'df.workers.de'+'v') with a DNS-TXT fallback to *.dl.wel1.ru (counted subdomains 'c.<domain>', '0.<domain>', '1.<domain>' concatenated and base64-decoded). The fetched bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod'd 0755, and executed detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref() or cmd.exe. Destination hostnames, the child_process import, and fs.chmodSync are assembled through string-splitting and property-name concatenation ('child_'+'process', 'chmod'+'Sync'), and payload filenames are disguised as 'dotnet_diag_*.exe' / '.analytics_state' with cover-story comments referencing telemetry and opt-out. A second, unreferenced dropper module lib/telemetry.js in the same tarball reimplements the same fetch-decode-chmod-spawn flow as an 'Analytics SDK'.
Affected packages
Package
Name: bigops-data-storage
Purl: pkg:npm/bigops-data-storage
Affected ranges
Type: N/A
Events:
