MAL-2026-13228

    Dashboard / Malicious Package / MAL-2026-13228

    MAL-2026-13228

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bigops-offers (npm)

    Details: Source: amazon-inspector (422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5) [email protected] executes a binary dropper at require time. index.js loads./_init on import; _init.js assembles C2 hostnames from split string arrays (workers.dev subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and fetches a platform-specific binary via https.get. A DNS TXT-record fallback assembles base64 payload chunks from c.dl.wel1.ru and 0..N.dl.wel1.ru (sdk/ext/pkg/net subdomains). The retrieved bytes are written to a disguised path (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0o755, and spawned detached via /bin/sh or cmd. A.analytics_state lock file and DISABLE_TELEMETRY/DO_NOT_TRACK env checks provide a telemetry cover story. Destinations, filenames, and delivery channels are string-split to evade static detection.

    References: https://www.npmjs.com/package/bigops-offers/v/35.6.8

    Affected packages

    Package

    Name: bigops-offers

    Purl: pkg:npm/bigops-offers

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.6.8
    MAL-2026-13228 | CVE-DB