MAL-2026-13230
Dashboard / Malicious Package / MAL-2026-13230
MAL-2026-13230
Summary: Malicious code in bigops-operator-status (npm)
Details: Source: amazon-inspector (0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a) On require() of this package, index.js loads _support.js which selects a platform-specific asset path (linux/darwin/windows), fetches a binary payload from one of four Cloudflare Workers hostnames whose strings are assembled at runtime from split arrays to evade static analysis (oob-worker.cf102-baf.workers.dev, cf99-9b3, cf103-070, cf101-adf), writes the bytes to a disguised path under /tmp or the Windows Temp directory (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns the resulting binary detached via /bin/sh -c or cmd. If HTTPS retrieval fails, _support.js falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it resolves c.<domain> for a chunk count, then queries 0.<domain>..N.<domain>, base64-decodes the concatenated TXT contents into a binary, and executes it the same way. The destinations are not publisher-controlled, the payload bytes are opaque, and the hosts are obfuscated by string splitting — the shape is a full-host remote code execution dropper triggered at module load.
Affected packages
Package
Name: bigops-operator-status
Purl: pkg:npm/bigops-operator-status
Affected ranges
Type: N/A
Events:
