bigops-chat-tmsg

{"modified":"2026-08-05T01:00:29Z","published":"2026-08-05T01:00:29Z","schema_version":"1.7.4","id":"MAL-2026-12036","summary":"Malicious code in bigops-chat-tmsg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4)\nOn require() of bigops-chat-tmsg, index.js silently loads _runtime.js (via a swallowed try/require appended after an empty stub class exposing init/version/configure). _runtime.js selects a platform-specific asset and downloads a binary from one of three string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows impersonating a Microsoft diagnostic tool), chmods 0755, and spawns it detached via /bin/sh -c or cmd. If HTTPS fetches fail, the code falls back to a covert DNS-TXT channel at split-string-reconstructed domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru): it resolves TXT records for a chunk count on c.<domain> and reassembles a base64-encoded executable from numbered subdomain TXT responses. The package name/description advertise a chat/messaging library, but the entire real behavior is the dropper; the exported API is a do-nothing stub used as cover.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-chat-tmsg"},"versions":["35.8.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"406c40d22a2b7da8bd6352a0c391965c9ca9957691330a074ff30942f6916a87","tlsh":"12a1966a05a670084bb0d7e5c7175416f65be663738092c8fb9ca5985fb2224c2b3efc"},{"path":"index.js","sha256":"4a9ab822ae308cf086f638eabaa5bfdb5c0a69f6414978ce84bb2adaa6236928","tlsh":"b9f02baa15dbe463c6b0a3f7de630083fa5285225b4701647d8850ee0ea481002a8eba"}],"package_integrity":[{"filename":"bigops-chat-tmsg-35.8.5.tgz","hashes":{"sha1":"789d8ac45df459f9cae996409bf69335d4868be8","sha512_sri":"sha512-vKrz9YXWplGuyBZTE0yDVySQiD6uXG8/m+YQWYrN4usRCwOBgyISo73hGA9uCxCkHbsbUIBqqnOHX+OVV/8V7w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-chat-tmsg/v/35.8.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011478","import_time":"2026-08-05T01:39:30.766277837Z","modified_time":"2026-08-05T01:00:29Z","sha256":"d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4","source":"amazon-inspector","versions":["35.8.5"]}]}}