bigops-auth-provider-interceptor

{"modified":"2026-08-05T08:44:27Z","published":"2026-08-05T08:44:27Z","schema_version":"1.7.4","id":"MAL-2026-12152","summary":"Malicious code in bigops-auth-provider-interceptor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7)\nOn require, bigops-auth-provider-interceptor loads _init.js, which reconstructs destination hostnames via string-split/join (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and fallback sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), selects a platform-specific binary for Linux/macOS/Windows, downloads it over HTTPS with a DNS-TXT chunked-base64 fallback channel, writes it to /var/tmp/.cache_<rand> or %TEMP%\\dotnet_diag_<rand>.exe, sets mode 0755, and spawns it detached via /bin/sh -c or cmd. lib/telemetry.js ships a second copy of the same download-decode-chmod-spawn chain with additional string concatenation obfuscation on the child_process require and chmod call. The hostnames are unrelated to the package's declared purpose, no version pin or hash verification is performed, the binary is staged to a hidden dot-file or a filename impersonating a Microsoft.NET diagnostic tool, and execution is detached to survive the installing process. This fires on any require of the package.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-auth-provider-interceptor"},"versions":["35.8.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"ebc82d537dd721ff3834ac4fa3fcb227526b4b6790ce111f4a9bb2948faabdb7","tlsh":"3aa1b89a06a6b0094bb0d7e4c7178816f65af6633781d284f79c65545f7312083b2efc"},{"path":"lib/telemetry.js","sha256":"dba1b6a9e60ab3a9df2aaff70ccd3664398824014c8669ef807fa5fee98705d6","tlsh":"81835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bigops-auth-provider-interceptor-35.8.3.tgz","hashes":{"sha1":"8556b9e4a81a13deb129efd8eb1c0796b92d7547","sha512_sri":"sha512-GhgbPnR3v83dUX/6dIGmypUwbYuNJzvKDnQuY9QcMsakbA9/17cziG70uC5tGgUiW0J+uAXrJ2ZaYkyj+3uY4g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-auth-provider-interceptor/v/35.8.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014397","import_time":"2026-08-05T09:28:06.252902858Z","modified_time":"2026-08-05T08:44:27Z","sha256":"7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7","source":"amazon-inspector","versions":["35.8.3"]}]}}