bigops-customer

{"modified":"2026-08-05T01:37:54Z","published":"2026-08-05T01:37:54Z","schema_version":"1.7.4","id":"MAL-2026-12038","summary":"Malicious code in bigops-customer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a)\nThe package's main entry requires `./_ext`, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf102-baf.workers.dev), assembled at runtime from split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmod 0755'd, and spawned detached via `/bin/sh` or `cmd.exe`. No hash or signature verification. A DNS TXT-record fallback channel (`c.<domain>` chunk count plus numbered subdomains, base64-decoded and joined) retrieves the payload when HTTPS fails. Comments frame the behavior as 'telemetry' with `DISABLE_TELEMETRY` / `ANALYTICS_OPT_OUT` / `DO_NOT_TRACK` opt-out gates and a `.analytics_state` re-run cooldown marker; the package description ('Bigops customer abstraction layer') is generic and unrelated to the actual code. Destinations are anonymous serverless hosts unrelated to any publisher identity; the fetched code is opaque and runs with the installer's privileges as a consequence of `require('bigops-customer')`.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-customer"},"versions":["35.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"1e88bba4c33a481621903bd2960918ce95317dd20934cbb6f63310eafbf67b18","tlsh":"66a1869616a6701847b09bf4c7279415f65bf6a323908284fb5ca9d81f7712883b2efc"}],"package_integrity":[{"filename":"bigops-customer-35.1.1.tgz","hashes":{"sha1":"b6c60c0ab821fba7a110d9570e428a16293a4338","sha512_sri":"sha512-RgZYAjbk3/W4b8uonGjvyhI4f5CKis97E33/SuIVbDnC44WuUSYKBmcBy4vF/5m4zUVCeCf+XQ/J+K+3zxRS9A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-customer/v/35.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011507","import_time":"2026-08-05T01:39:32.045228801Z","modified_time":"2026-08-05T01:37:54Z","sha256":"59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a","source":"amazon-inspector","versions":["35.1.1"]}]}}