MAL-2026-13245

    Dashboard / Malicious Package / MAL-2026-13245

    MAL-2026-13245

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bigops-products-timeline (npm)

    Details: Source: amazon-inspector (f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8) On require(), index.js loads _vendor.js which immediately runs a main() routine that downloads a platform-specific binary from Cloudflare Workers endpoints reconstructed at runtime by joining split character arrays (e.g. ['oob-worke','r.cf100-416.workers.d','ev'].join('')), with a DNS TXT fallback resolving *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). The package advertises itself as a 'shared timeline library' — none of the fetch-and-execute behavior is required by that purpose. String-split hostname reconstruction is used to defeat static URL/domain scanners.

    References: https://www.npmjs.com/package/bigops-products-timeline/v/35.8.9

    Affected packages

    Package

    Name: bigops-products-timeline

    Purl: pkg:npm/bigops-products-timeline

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.9