bigops-products-savings-accounts

{"modified":"2026-08-05T15:34:42Z","published":"2026-08-05T15:34:42Z","schema_version":"1.7.4","id":"MAL-2026-13244","summary":"Malicious code in bigops-products-savings-accounts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (390c683f6a93a099bb09a5590ebc84cd61391ee25d553d009350117c142a9c43)\nOn require() of bigops-products-savings-accounts, _ext.js reconstructs C2 hostnames via Array.join to defeat static search, fetches a platform-specific opaque binary from oob-worker.cf101-adf.workers.dev (with a DNS-TXT chunked-base64 fallback resolver via sdk.dl.wel1.ru), writes it to /var/tmp/.cache_<hex> on Linux or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp + \" &\"], {detached:true}) or spawn(\"cmd\",...). lib/telemetry.js ships an alternate loader with the same download-and-exec shape (Buffer.from(chunks,'base64'), cp.spawn('/bin/sh',['-c',filePath+' &']), fs['chmod'+'Sync'](...,0o755)) under an 'Analytics SDK' cover story. Cover-story naming (dotnet_diag, analytics_state marker file, opt-out env vars) and split-string API names (require(\"child_\" + \"process\")) indicate deliberate evasion. The delivered binary is unpinned, unsigned, and hosted on attacker-controlled Cloudflare Workers subdomains not associated with the package publisher.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-products-savings-accounts"},"versions":["35.3.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"7629c6b2df2a9ef0a47d111f43f9619792937729a4223389b27ba1033e15c034","tlsh":"19a1775a056570298b709be487178416f66be6a33380c5c4fb6c69945fb7128c2b2efc"},{"path":"lib/telemetry.js","sha256":"e9c66919d9a9c83135eed391307db545bc08019f1846a18071d97572ed4ad2b8","tlsh":"d2835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bigops-products-savings-accounts-35.3.7.tgz","hashes":{"sha1":"aa29be695eedc9c4469a4ed4183c866c3f42fbcc","sha512_sri":"sha512-Hb6XTwOHq2Pg5XAfwwwGHtsUgBzoYoP/UkTd9AbC4HDHJI66w8OVtgzFMMtu/h3aGLtqW5+2U6SDwm9uDRm/qQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-products-savings-accounts/v/35.3.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015752","import_time":"2026-08-05T16:13:40.324180234Z","modified_time":"2026-08-05T15:34:42Z","sha256":"390c683f6a93a099bb09a5590ebc84cd61391ee25d553d009350117c142a9c43","source":"amazon-inspector","versions":["35.3.7"]}]}}