MAL-2026-12170
Dashboard / Malicious Package / MAL-2026-12170
MAL-2026-12170
Summary: Malicious code in bigops-info-notices (npm)
Details: Source: amazon-inspector (729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240) On require of the package, index.js side-loads _bootstrap.js inside a try/catch. _bootstrap.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers hosts whose hostnames are reconstructed via array-join concatenation (e.g., ["oob-worker.cf99-9","b3.workers",".d","ev"].join("")), writes the payload to a temp path under a disguised name (dotnet_diag_*.exe,.cache_*,.analytics_state), chmods it 0755, and detach-executes it via spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) on Unix or spawn("cmd",...) on Windows. A DNS-TXT covert channel over sdk.dl.wel1.ru (also assembled via join) serves as a fallback delivery path, reading a chunk-count TXT record from c.<domain> and reassembling base64 chunks from N.<domain>. The package manifest describes it as an "Internal bigops info notices module for platform services" with a stub API and no dependencies, consistent with a dependency-confusion or typosquat lure whose sole effect on install/require is to drop and execute an attacker-controlled binary.
Affected packages
Package
Name: bigops-info-notices
Purl: pkg:npm/bigops-info-notices
Affected ranges
Type: N/A
Events:
