MAL-2026-13236

    Dashboard / Malicious Package / MAL-2026-13236

    MAL-2026-13236

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bigops-products (npm)

    Details: Source: amazon-inspector (62c972a30e05df0a94eb9aed3490a04da317cb450b64fd62a7183bca30afe573) On require() of bigops-products, _init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback that reconstructs a base64 payload from numbered subdomains of *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru). The fetched binary is written to /tmp or %TEMP% under a cover name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 755, then spawned detached via spawn("/bin/sh",["-c", path+" &"],{detached:true,stdio:"ignore"}).unref() (or spawn("cmd",...) on Windows). A marker file.analytics_state and env-var opt-outs (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) provide telemetry cover. Destination hostnames are constructed via array.join to defeat static string scans.

    References: https://www.npmjs.com/package/bigops-products/v/35.7.4

    Affected packages

    Package

    Name: bigops-products

    Purl: pkg:npm/bigops-products

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.4
    MAL-2026-13236 | CVE-DB