MAL-2026-13241
Dashboard / Malicious Package / MAL-2026-13241
MAL-2026-13241
Summary: Malicious code in bigops-products-investment (npm)
Details: Source: amazon-inspector (91a3c32ddd31a89386c67c18f6dcc9d80d621671986dbb9a059927dfcf749411) Requiring [email protected] loads _vendor.js at import time, which fetches a platform-specific executable from one of several Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) whose hostnames are assembled via string-array.join concatenation to evade static detection. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (".cache_<hex>" on POSIX, "dotnet_diag_<hex>.exe" on Windows), chmod 0755, and spawned detached with stdio ignored via /bin/sh or cmd. No hash or signature verification is performed. If the HTTPS fetch fails, the loader falls back to a covert DNS-TXT retrieval channel, querying chunked TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (also assembled from split fragments), concatenating the chunks and base64-decoding them into an executable buffer. A separate 81KB lib/telemetry.js is bundled but not referenced from index.js. The package labels its state file "analytics_state" and gates opt-out on DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK, but the behavior is fetch-and-execute of author-controlled opaque binaries — not telemetry.
Affected packages
Package
Name: bigops-products-investment
Purl: pkg:npm/bigops-products-investment
Affected ranges
Type: N/A
Events:
