bigops-abstract-entity-data

{"modified":"2026-08-07T12:27:27Z","published":"2026-08-07T12:27:27Z","schema_version":"1.7.4","id":"MAL-2026-13524","summary":"Malicious code in bigops-abstract-entity-data (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (294402f19750cb519f7bdcf28e24e057513e0fc59cbfa4bc8e24a39b93832351)\nindex.js unconditionally requires./_loader on module load. _loader.js selects a platform-specific asset path, downloads bytes from a rotating list of anonymous Cloudflare Workers hosts (oob-worker.cf101-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-*.workers.dev, cf99-9b3.workers.dev) with a DNS-TXT chunked fallback resolved under *.dl.wel1.ru, writes the bytes to /tmp or %TEMP% under decoy names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmods 0755, and spawns the resulting file detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames and resolver domains are reconstructed at runtime from split string arrays rather than kept as literals; no hash or signature verification is performed on the downloaded bytes. Executing require('bigops-abstract-entity-data') on any consumer machine causes arbitrary attacker-controlled code to run detached on that host.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-abstract-entity-data"},"versions":["35.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"7a97c9824ffe15c7c00044b29d8fa46d5d3869104a987719ab412adbf0d12216","tlsh":"c3a1549a166a71194bb0abf4871b4419f65bf76323808294f75ca9942fb312483b1efc"}],"package_integrity":[{"filename":"bigops-abstract-entity-data-35.1.7.tgz","hashes":{"sha1":"4f3c55100a6ae9122ef0487ecf912bd4eacab111","sha512_sri":"sha512-BkHab2t81q5/tgMckvsigqFsDVh40G2exozBi0OJiwBb55zbt4GRGbNbOhle2KSd89UZal6DrJb28aDsrddHiw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-abstract-entity-data/v/35.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016988","import_time":"2026-08-07T12:51:21.133152978Z","modified_time":"2026-08-07T12:27:27Z","sha256":"294402f19750cb519f7bdcf28e24e057513e0fc59cbfa4bc8e24a39b93832351","source":"amazon-inspector","versions":["35.1.7"]}]}}