bigops-products

{"modified":"2026-08-05T15:36:14Z","published":"2026-08-05T15:36:14Z","schema_version":"1.7.4","id":"MAL-2026-13236","summary":"Malicious code in bigops-products (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (62c972a30e05df0a94eb9aed3490a04da317cb450b64fd62a7183bca30afe573)\nOn require() of bigops-products, _init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback that reconstructs a base64 payload from numbered subdomains of *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru). The fetched binary is written to /tmp or %TEMP% under a cover name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 755, then spawned detached via spawn(\"/bin/sh\",[\"-c\", path+\" &\"],{detached:true,stdio:\"ignore\"}).unref() (or spawn(\"cmd\",...) on Windows). A marker file.analytics_state and env-var opt-outs (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) provide telemetry cover. Destination hostnames are constructed via array.join to defeat static string scans.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-products"},"versions":["35.7.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"d3d99f4e319c039f686e625da428f42fae5669d4138433a50df0bf25fa52fa24","tlsh":"70b1746a156571184bb0dbe4c6175416f65af6637780c288f79ca9980ff222482f2efc"}],"package_integrity":[{"filename":"bigops-products-35.7.4.tgz","hashes":{"sha1":"36c2a4d0b77f33d6e3df99e099bbb1317ee87adc","sha512_sri":"sha512-IDsjKNIkwzphKH3adT26g6Pv2Pgf57zMqWktj3eK003CpAHktsGTlYOBzYn1lIUjF+x8ZNdazMK1ioleNnZjiw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-products/v/35.7.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015762","import_time":"2026-08-05T16:13:42.456083082Z","modified_time":"2026-08-05T15:36:14Z","sha256":"62c972a30e05df0a94eb9aed3490a04da317cb450b64fd62a7183bca30afe573","source":"amazon-inspector","versions":["35.7.4"]}]}}