bigops-data-storage

{"modified":"2026-08-05T08:46:12Z","published":"2026-08-05T08:46:12Z","schema_version":"1.7.4","id":"MAL-2026-12163","summary":"Malicious code in bigops-data-storage (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0)\nOn require() of bigops-data-storage, index.js loads _compat.js which unconditionally runs a top-level routine that downloads a native executable from hardcoded Cloudflare Workers hosts (reconstructed via array-join, e.g. 'oob-worker.cf101-a'+'df.workers.de'+'v') with a DNS-TXT fallback to *.dl.wel1.ru (counted subdomains 'c.<domain>', '0.<domain>', '1.<domain>' concatenated and base64-decoded). The fetched bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmod'd 0755, and executed detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref() or cmd.exe. Destination hostnames, the child_process import, and fs.chmodSync are assembled through string-splitting and property-name concatenation ('child_'+'process', 'chmod'+'Sync'), and payload filenames are disguised as 'dotnet_diag_*.exe' / '.analytics_state' with cover-story comments referencing telemetry and opt-out. A second, unreferenced dropper module lib/telemetry.js in the same tarball reimplements the same fetch-decode-chmod-spawn flow as an 'Analytics SDK'.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-data-storage"},"versions":["35.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"fe97b6b172030f88fffb4199f14fb408d8f80c7ff6b13c265efee8b0f9cbd94b","tlsh":"cfa1869a12a630098bb0dbe0c7175416f65be6733780d294fb5c65945f7312483b2efc"},{"path":"lib/telemetry.js","sha256":"a9fc327a476795521d17fb72c3714838f4b57732f0353fc5b7cce1c89504b1ec","tlsh":"ca835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bigops-data-storage-35.7.1.tgz","hashes":{"sha1":"df2583d10ae3572a44cf9ad0bd2865e036d65100","sha512_sri":"sha512-0nc/QMqoK03SQdKWR7ZBwVKgCEX276j7owNHr9jlnebXLNvGxqR75I9jK1641sHKRL684wYMmuJ39CFO7dhc/Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-data-storage/v/35.7.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014409","import_time":"2026-08-05T09:28:07.809016384Z","modified_time":"2026-08-05T08:46:12Z","sha256":"3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0","source":"amazon-inspector","versions":["35.7.1"]}]}}