bigops-offers

{"modified":"2026-08-05T15:37:11Z","published":"2026-08-05T15:37:11Z","schema_version":"1.7.4","id":"MAL-2026-13228","summary":"Malicious code in bigops-offers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5)\nbigops-offers@35.6.8 executes a binary dropper at require time. index.js loads./_init on import; _init.js assembles C2 hostnames from split string arrays (workers.dev subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and fetches a platform-specific binary via https.get. A DNS TXT-record fallback assembles base64 payload chunks from c.dl.wel1.ru and 0..N.dl.wel1.ru (sdk/ext/pkg/net subdomains). The retrieved bytes are written to a disguised path (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0o755, and spawned detached via /bin/sh or cmd. A.analytics_state lock file and DISABLE_TELEMETRY/DO_NOT_TRACK env checks provide a telemetry cover story. Destinations, filenames, and delivery channels are string-split to evade static detection.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-offers"},"versions":["35.6.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"e14fd81ab62a957ed4d24051f5f930b796032f820920b7a10df74c300261bef0","tlsh":"a5a1969a0266701987b0dbe48b175416f66be66333c0c6c4fb6c69841f7312483b2efc"}],"package_integrity":[{"filename":"bigops-offers-35.6.8.tgz","hashes":{"sha1":"f1f1027120120fbfd73719f699ea19f940cb67d9","sha512_sri":"sha512-RiqQbscpUDA2NLg6dxbKVK64xl1Jyhu4wOPYS7121K1YyrWJIAmdu3noB/gjb0aJlDzzo9elOah0yRktQWnOGw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-offers/v/35.6.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015768","import_time":"2026-08-05T16:13:43.109907247Z","modified_time":"2026-08-05T15:37:11Z","sha256":"422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5","source":"amazon-inspector","versions":["35.6.8"]}]}}