bigops-tcrm-permissions

{"schema_version":"1.7.4","id":"MAL-2026-12839","published":"2026-08-05T15:01:52Z","modified":"2026-08-05T21:33:14.273858747Z","summary":"Malicious code in bigops-tcrm-permissions (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a20b19aa6d3666cf99d03011aefd683f0d560b45dac6f27c2915dd68dd95bc0d)\nOn require of bigops-tcrm-permissions, index.js loads _runtime.js which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes the bytes to /var/tmp or %TEMP% under a hidden/decoy name, chmods the file 0755, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed, and the destinations are not associated with the package publisher. Destination hostnames and dangerous API names (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) are reassembled at runtime from string fragments to evade static matching. lib/telemetry.js contains a duplicate dropper flow (base64-assembled chunks, write, chmod 755, spawn /bin/sh detached) under an 'Analytics SDK' cover story, providing a second execution path against the same C2 infrastructure. The advertised purpose is a permissions SDK; dropping and executing native binaries from unrelated infrastructure is inconsistent with that purpose.\n","affected":[{"package":{"name":"bigops-tcrm-permissions","ecosystem":"npm"},"versions":["35.5.1","35.6.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"c024a07ce07e2ba1ef84b11fc02d18adf3ef3b2ca53ca228faaf0b9678e24abf","tlsh":"b4a1c69a156670198bb0e7e4c717581af65bf6633380c688fb9c65881f7252483b1efc"},{"path":"lib/telemetry.js","sha256":"8b9db669fed99ca42598f32325243161553524995147d358e7c3d1eb80d286d6","tlsh":"88835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bigops-tcrm-permissions-35.5.1.tgz","hashes":{"sha1":"1b43c056ee9952c53dec29520fafbb148c6e81ef","sha512_sri":"sha512-fkEmMKu2lzM2rtEpsZYO5TbYyC5iY81Lta4pRU0y7DGJHssNDl1jdp9WAKmbtEgtLbF53hw2/jNdFssZ/oDNvg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-tcrm-permissions/v/35.5.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-tcrm-permissions/v/35.6.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015540","import_time":"2026-08-05T15:19:56.855133183Z","modified_time":"2026-08-05T15:01:52Z","sha256":"a20b19aa6d3666cf99d03011aefd683f0d560b45dac6f27c2915dd68dd95bc0d","source":"amazon-inspector","versions":["35.5.1"]},{"id":"IN-MAL-2026-015888","import_time":"2026-08-05T21:31:20.547869464Z","modified_time":"2026-08-05T21:02:56Z","sha256":"8ed0adaa078f72d10e3e479f54d4f71f5cb9b7a1f78c0007305c505cb8dc074d","source":"amazon-inspector","versions":["35.6.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}