MAL-2026-12036

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-chat-tmsg/MAL-2026-12036.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12036
Published
2026-08-05T01:00:29Z
Modified
2026-08-05T01:49:47.774563590Z
Summary
Malicious code in bigops-chat-tmsg (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4)

On require() of bigops-chat-tmsg, index.js silently loads runtime.js (via a swallowed try/require appended after an empty stub class exposing init/version/configure). runtime.js selects a platform-specific asset and downloads a binary from one of three string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnetdiag_<hex>.exe on Windows impersonating a Microsoft diagnostic tool), chmods 0755, and spawns it detached via /bin/sh -c or cmd. If HTTPS fetches fail, the code falls back to a covert DNS-TXT channel at split-string-reconstructed domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru): it resolves TXT records for a chunk count on c.<domain> and reassembles a base64-encoded executable from numbered subdomain TXT responses. The package name/description advertise a chat/messaging library, but the entire real behavior is the dropper; the exported API is a do-nothing stub used as cover.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.5"
            ],
            "sha256": "d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4",
            "import_time": "2026-08-05T01:39:30.766277837Z",
            "id": "IN-MAL-2026-011478",
            "modified_time": "2026-08-05T01:00:29Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-chat-tmsg

Package

Name
bigops-chat-tmsg
View open source insights on deps.dev
Purl
pkg:npm/bigops-chat-tmsg

Affected ranges

Affected versions

35.*
35.8.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-chat-tmsg-35.8.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-vKrz9YXWplGuyBZTE0yDVySQiD6uXG8/m+YQWYrN4usRCwOBgyISo73hGA9uCxCkHbsbUIBqqnOHX+OVV/8V7w==",
                "sha1": "789d8ac45df459f9cae996409bf69335d4868be8"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_runtime.js",
            "sha256": "406c40d22a2b7da8bd6352a0c391965c9ca9957691330a074ff30942f6916a87",
            "tlsh": "12a1966a05a670084bb0d7e5c7175416f65be663738092c8fb9ca5985fb2224c2b3efc"
        },
        {
            "path": "index.js",
            "sha256": "4a9ab822ae308cf086f638eabaa5bfdb5c0a69f6414978ce84bb2adaa6236928",
            "tlsh": "b9f02baa15dbe463c6b0a3f7de630083fa5285225b4701647d8850ee0ea481002a8eba"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-chat-tmsg/MAL-2026-12036.json"