MAL-2026-11535

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-backend/MAL-2026-11535.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11535
Published
2026-08-04T22:08:25Z
Modified
2026-08-04T23:04:52.550899809Z
Summary
Malicious code in bigops-backend (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41)

On require(), adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames (assembled at runtime by joining string fragments such as ["oob-worker.cf100-416.w","orke","rs.","dev"]), downloads an opaque binary over HTTPS with no version pin and no hash verification, writes it to /var/tmp/.cache<rand> or %TEMP%\dotnetdiag<rand>.exe under a cover-story name, chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true, stdio:"ignore"}).unref(). A DNS TXT-record fallback channel reassembles a base64 payload from numbered subdomains under *.dl.wel1.ru (hostname also constructed by split-and-join at runtime) when HTTPS is blocked. lib/telemetry.js in the same tarball contains the same dropper shape (cp.spawn to /bin/sh, chmodSync 0755, base64 reassembly from DNS chunks) behind an "Analytics SDK" cover story. The runtime hostname reconstruction, the DNS-TXT covert channel, the disguised staging paths, and the detached background execution grant arbitrary remote code execution on any host that installs or requires this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-04T22:08:25Z",
            "sha256": "4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41",
            "id": "IN-MAL-2026-011347",
            "versions": [
                "35.8.3"
            ],
            "import_time": "2026-08-04T22:30:11.995488966Z"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-backend

Package

Name
bigops-backend
View open source insights on deps.dev
Purl
pkg:npm/bigops-backend

Affected ranges

Affected versions

35.*
35.8.3

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-KGySyA6Exdj1fRywNVoe2zpjrcxnfDieug69Au0HP4W+xVIcEgJ7sxE0/AVsUSQDKgyu/sY5Iqby/dcT0rzzxg==",
                "sha1": "8effb8bcfdbc544327c18712e89d524b692f64f5"
            },
            "filename": "bigops-backend-35.8.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_adapter.js",
            "sha256": "f901c6116eb181294f7439b1dadcc749547d356c0ecb812dc2c93a7a12ac0f97",
            "tlsh": "f9a1759a166a70184bb0e7f486174416f65be6a33380c6d4fb5c69985fb312482b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "1131f4d315b2f94c3917294cde8ba079566c0e2dba4dfb0662113df291bfceb2",
            "tlsh": "fc835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-backend/MAL-2026-11535.json"