bigops-backend

{"modified":"2026-08-04T22:08:25Z","published":"2026-08-04T22:08:25Z","schema_version":"1.7.4","id":"MAL-2026-11535","summary":"Malicious code in bigops-backend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41)\nOn require(), _adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames (assembled at runtime by joining string fragments such as [\"oob-worker.cf100-416.w\",\"orke\",\"rs.\",\"dev\"]), downloads an opaque binary over HTTPS with no version pin and no hash verification, writes it to /var/tmp/.cache_<rand> or %TEMP%\\dotnet_diag_<rand>.exe under a cover-story name, chmods it 0755, and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp + \" &\"], {detached:true, stdio:\"ignore\"}).unref(). A DNS TXT-record fallback channel reassembles a base64 payload from numbered subdomains under *.dl.wel1.ru (hostname also constructed by split-and-join at runtime) when HTTPS is blocked. lib/telemetry.js in the same tarball contains the same dropper shape (cp.spawn to /bin/sh, chmodSync 0755, base64 reassembly from DNS chunks) behind an \"Analytics SDK\" cover story. The runtime hostname reconstruction, the DNS-TXT covert channel, the disguised staging paths, and the detached background execution grant arbitrary remote code execution on any host that installs or requires this package.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-backend"},"versions":["35.8.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"f901c6116eb181294f7439b1dadcc749547d356c0ecb812dc2c93a7a12ac0f97","tlsh":"f9a1759a166a70184bb0e7f486174416f65be6a33380c6d4fb5c69985fb312482b2efc"},{"path":"lib/telemetry.js","sha256":"1131f4d315b2f94c3917294cde8ba079566c0e2dba4dfb0662113df291bfceb2","tlsh":"fc835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bigops-backend-35.8.3.tgz","hashes":{"sha1":"8effb8bcfdbc544327c18712e89d524b692f64f5","sha512_sri":"sha512-KGySyA6Exdj1fRywNVoe2zpjrcxnfDieug69Au0HP4W+xVIcEgJ7sxE0/AVsUSQDKgyu/sY5Iqby/dcT0rzzxg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-backend/v/35.8.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011347","import_time":"2026-08-04T22:30:11.995488966Z","modified_time":"2026-08-04T22:08:25Z","sha256":"4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41","source":"amazon-inspector","versions":["35.8.3"]}]}}