MAL-2026-12168

    Dashboard / Malicious Package / MAL-2026-12168

    MAL-2026-12168

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bigops-frontend-bigops-frontend-core (npm)

    Details: Source: amazon-inspector (7bb3c97636fded3935088ac125f923882844470f5638c45176b4254d4dbad714) On require() of the package, _vendor.js downloads a platform-selected native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked-base64 fallback via subdomains of dl.wel1.ru, writes it to a temp path under a decoy filename (dotnet_diag_*.exe on Windows,.cache_* on Unix), chmods 0755, and spawns it detached via cmd.exe or /bin/sh. Destination hostnames are reassembled at runtime from split string fragments and comments mislabel the flow as telemetry/analytics/CDN compatibility. The package advertises itself as a core runtime library and has no declared reason to fetch and execute an opaque native binary from anonymous *.workers.dev hosts on import.

    References: https://www.npmjs.com/package/bigops-frontend-bigops-frontend-core/v/35.1.5

    Affected packages

    Package

    Name: bigops-frontend-bigops-frontend-core

    Purl: pkg:npm/bigops-frontend-bigops-frontend-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.1.5