MAL-2026-13229

Dashboard / Malicious Package / MAL-2026-13229

MAL-2026-13229

Summary: Malicious code in bigops-opening-file-handler (npm)

Details: Source: amazon-inspector (9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39) On require of bigops-opening-file-handler, index.js loads _support.js which selects a platform-specific asset (linux/darwin/win32) and downloads an opaque native binary from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT discovery fallback under *.dl.wel1.ru (e.g. sdk.dl.wel1.ru). The hostnames are reassembled at runtime from string arrays via.join('') to evade static matching. The fetched bytes are written to /var/tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmodded 0755, and spawned detached via /bin/sh -c or cmd. The package advertises itself as a file-handler abstraction; the delivered payload is unrelated native code from author-controlled infrastructure, executed automatically when the module is required.

References: https://www.npmjs.com/package/bigops-opening-file-handler/v/35.9.2