MAL-2026-12171
Dashboard / Malicious Package / MAL-2026-12171
MAL-2026-12171
Summary: Malicious code in bigops-informer (npm)
Details: Source: amazon-inspector (324bb851ecf14c623080e07471bd23a7ea505bc6db244c654895a1cce71bf7e8) On require(), index.js loads _bootstrap.js which reconstructs a set of destination hostnames from string-array joins (resolving to oob-worker.cf99-9b3.workers.dev, cf101-adf/cf102-baf/cf103-070.workers.dev, and sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), downloads a platform-specific executable via https.get, writes it to a temp path under disguised names (dotnet_diag_*.exe /.cache_*), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &']) or spawn('cmd',...) on Windows. If the HTTPS mirrors fail, _bootstrap.js falls back to a DNS TXT covert channel: it resolves c.<domain> to get a chunk count, then resolves N.<domain> for each chunk, concatenates the base64 chunks, decodes them to a binary buffer, and writes+executes the result. The module also includes a TTL stamp and env-based opt-out checks consistent with hostile staging.
Affected packages
Package
Name: bigops-informer
Purl: pkg:npm/bigops-informer
Affected ranges
Type: N/A
Events:
