MAL-2026-12150

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-auth-cache/MAL-2026-12150.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12150

Published

2026-08-05T08:46:38Z

Modified

2026-08-05T10:05:52.582034288Z

Summary

Malicious code in bigops-auth-cache (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542)

On require('bigops-auth-cache'), index.js loads compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) and *.dl.wel1.ru domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to a temp file with a disguised name (dotnetdiag_*.exe /.cache_*), chmods 0755, and spawns it detached via cmd.exe or /bin/sh (_compat.js line 124-130). Hostnames are assembled at runtime from split-string arrays (['sdk.dl.w','el1','.ru'].join('')) to evade static detection. A DNS TXT-record covert channel serves as fallback payload delivery: a count record at c.<domain> and chunked base64 payload at N.<domain> are reassembled and executed. No hash or signature verification. Cover-story comments describe the code as 'analytics' / 'telemetry' / 'session management', contradicting the observed dropper behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014412",
            "import_time": "2026-08-05T09:28:08.241070406Z",
            "sha256": "f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542",
            "versions": [
                "35.3.9"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:46:38Z"
        }
    ]
}

References

https://www.npmjs.com/package/bigops-auth-cache/v/35.3.9

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / bigops-auth-cache

Package

Name: bigops-auth-cache; View open source insights on deps.dev
Purl: pkg:npm/bigops-auth-cache

Affected ranges

Affected versions

35.*

35.3.9

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "_compat.js",
            "tlsh": "5db195a6129a70188bb0e7e0c71b5816f65bf66337c182d4f79c95984f7252483b2efc",
            "sha256": "c55fb34e1a3eb00a9835a2aa0889fd4798b26de2a71fefebbda49eed6c980183"
        }
    ],
    "package_integrity": [
        {
            "filename": "bigops-auth-cache-35.3.9.tgz",
            "hashes": {
                "sha1": "bab45902cef9fcba32e9f849bcebfa0d0d8c286a",
                "sha512_sri": "sha512-KCMkCE0Ub5NxyQxQfSrruA1Q5IppWdiktMT66QtGFwc1YYtdUlYhgwY53bsaSM8LVKm+EaMB3/u/xr0oABZONg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-auth-cache/MAL-2026-12150.json"