bigops-products-investment

{"modified":"2026-08-05T15:35:11Z","published":"2026-08-05T15:35:11Z","schema_version":"1.7.4","id":"MAL-2026-13241","summary":"Malicious code in bigops-products-investment (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (91a3c32ddd31a89386c67c18f6dcc9d80d621671986dbb9a059927dfcf749411)\nRequiring bigops-products-investment@35.3.1 loads _vendor.js at import time, which fetches a platform-specific executable from one of several Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) whose hostnames are assembled via string-array.join concatenation to evade static detection. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (\".cache_<hex>\" on POSIX, \"dotnet_diag_<hex>.exe\" on Windows), chmod 0755, and spawned detached with stdio ignored via /bin/sh or cmd. No hash or signature verification is performed. If the HTTPS fetch fails, the loader falls back to a covert DNS-TXT retrieval channel, querying chunked TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (also assembled from split fragments), concatenating the chunks and base64-decoding them into an executable buffer. A separate 81KB lib/telemetry.js is bundled but not referenced from index.js. The package labels its state file \"analytics_state\" and gates opt-out on DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK, but the behavior is fetch-and-execute of author-controlled opaque binaries — not telemetry.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-products-investment"},"versions":["35.3.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"dbfaac6648dd912aaf658736aec598f149c21755bf946ae1430ae1a31ea0f325","tlsh":"3aa1a65a06a7701d8bb0ebf4c7075416f65ae66336808294fb9c6a841f7727483b2dfc"}],"package_integrity":[{"filename":"bigops-products-investment-35.3.1.tgz","hashes":{"sha1":"d01d31f7a85f26ad56e5191b8f2c3fb95bcd7934","sha512_sri":"sha512-qFfCxCG4T9VqbJ7kB+yVueYvhH18MfmzEX5/Eczicv8pPhOcdgozG4C5T2hFcEn3S86P1mvdbefanjUoIjA67Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-products-investment/v/35.3.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015755","import_time":"2026-08-05T16:13:40.887917715Z","modified_time":"2026-08-05T15:35:11Z","sha256":"91a3c32ddd31a89386c67c18f6dcc9d80d621671986dbb9a059927dfcf749411","source":"amazon-inspector","versions":["35.3.1"]}]}}