MAL-2026-13234
Dashboard / Malicious Package / MAL-2026-13234
MAL-2026-13234
Summary: Malicious code in bigops-procedure-player (npm)
Details: Source: amazon-inspector (4e28923577eff8eba09d7ebbd941220727c1851cf46ef25f4de8960070ad33bb) On require(), index.js loads _loader.js, which reconstructs delivery hostnames at runtime via array.join("") (e.g. oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and fetches an OS-specific binary via https.get. A fallback path assembles the payload from base64 chunks in DNS TXT records under *.dl.wel1.ru (a count record at c.<domain> and per-chunk records at <i>.<domain>). The received bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod'd 755 via a string-concatenated fs["chmod"+"Sync"], and executed detached via cp.spawn("/bin/sh", ["-c", fp+" &"]) or the cmd equivalent. Filenames masquerade as system cache/diagnostic artifacts and the delivery hosts are unrelated to the package publisher. lib/telemetry.js contains a duplicate fetch->chmod 755->detached-spawn dropper body that is not reached from index.js in this version but mirrors the same loader shape.
Affected packages
Package
Name: bigops-procedure-player
Purl: pkg:npm/bigops-procedure-player
Affected ranges
Type: N/A
Events:
