MAL-2026-12035

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-auth-utils/MAL-2026-12035.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12035
Published
2026-08-05T01:31:03Z
Modified
2026-08-05T01:49:47.486261513Z
Summary
Malicious code in bigops-auth-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ba54cfc2b542b8e388d852b80c0f409b2987423285eb6518d6dbc668e4c1a372)

bigops-auth-utils@35.4.5 executes an install-time binary dropper on any require/import of the package. index.js top-level runs require('./setup'), which selects an OS/arch-specific asset path and downloads a binary over HTTPS from one of three string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT covert-channel fallback that reassembles base64-encoded chunks from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a disguising name (.cache<hex> on POSIX, dotnetdiag<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c... & or cmd.exe /c start /b. A TTL marker suppresses re-execution and env-var opt-out flags are named to resemble telemetry toggles. A second copy of the same drop-and-spawn logic is duplicated inside lib/telemetry.js framed as an 'Analytics SDK', with require("child" + "process"), fs["chmod" + "Sync"], and cp.spawn('/bin/sh', ['-c', filePath + ' &']) using string concatenation to evade static matching. Host construction via array-join splitting, cover-story framing, telemetry-shaped opt-out names, DNS covert-channel fallback, and duplicated execution paths are all evasion signals characteristic of a supply-chain dropper, not a build helper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T01:31:03Z",
            "sha256": "ba54cfc2b542b8e388d852b80c0f409b2987423285eb6518d6dbc668e4c1a372",
            "id": "IN-MAL-2026-011498",
            "versions": [
                "35.4.5"
            ],
            "import_time": "2026-08-05T01:39:31.728580563Z"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-auth-utils

Package

Name
bigops-auth-utils
View open source insights on deps.dev
Purl
pkg:npm/bigops-auth-utils

Affected ranges

Affected versions

35.*
35.4.5

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-j9uWq7vZUi80e4ru66YZMm6iPRGy0zbudGXj9GwOro698abs31IE/qn+soxzCa+egQoTsyT0VqivG0ODczfDOg==",
                "sha1": "42ad82d1832d117c9964b711b631e6e7dd980a12"
            },
            "filename": "bigops-auth-utils-35.4.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "setup.js",
            "sha256": "c09efc54d5929254408ac006e3dee64069f3fccd28b4ff713bbfeabeaa1e4192",
            "tlsh": "4da1975a166ab0188bb0ebe4c71b8815f55af6633780c294f79c69885fb3114c371efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "b1197b0c8bcf9ee3da662daf24defcb3e3c486fad3dcb59d28dbb7736b2e580b",
            "tlsh": "29835056566a102186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-auth-utils/MAL-2026-12035.json"