MAL-2026-12038

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-customer/MAL-2026-12038.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12038
Published
2026-08-05T01:37:54Z
Modified
2026-08-05T01:49:48.683659248Z
Summary
Malicious code in bigops-customer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a)

The package's main entry requires ./_ext, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf102-baf.workers.dev), assembled at runtime from split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh or cmd.exe. No hash or signature verification. A DNS TXT-record fallback channel (c.<domain> chunk count plus numbered subdomains, base64-decoded and joined) retrieves the payload when HTTPS fails. Comments frame the behavior as 'telemetry' with DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK opt-out gates and a .analytics_state re-run cooldown marker; the package description ('Bigops customer abstraction layer') is generic and unrelated to the actual code. Destinations are anonymous serverless hosts unrelated to any publisher identity; the fetched code is opaque and runs with the installer's privileges as a consequence of require('bigops-customer').

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-011507",
            "modified_time": "2026-08-05T01:37:54Z",
            "import_time": "2026-08-05T01:39:32.045228801Z",
            "source": "amazon-inspector",
            "sha256": "59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a",
            "versions": [
                "35.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-customer

Package

Name
bigops-customer
View open source insights on deps.dev
Purl
pkg:npm/bigops-customer

Affected ranges

Affected versions

35.*
35.1.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "b6c60c0ab821fba7a110d9570e428a16293a4338",
                "sha512_sri": "sha512-RgZYAjbk3/W4b8uonGjvyhI4f5CKis97E33/SuIVbDnC44WuUSYKBmcBy4vF/5m4zUVCeCf+XQ/J+K+3zxRS9A=="
            },
            "filename": "bigops-customer-35.1.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_ext.js",
            "tlsh": "66a1869616a6701847b09bf4c7279415f65bf6a323908284fb5ca9d81f7712883b2efc",
            "sha256": "1e88bba4c33a481621903bd2960918ce95317dd20934cbb6f63310eafbf67b18"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-customer/MAL-2026-12038.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]