MAL-2026-12152

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-auth-provider-interceptor/MAL-2026-12152.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12152
Published
2026-08-05T08:44:27Z
Modified
2026-08-05T10:05:53.988424768Z
Summary
Malicious code in bigops-auth-provider-interceptor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7)

On require, bigops-auth-provider-interceptor loads init.js, which reconstructs destination hostnames via string-split/join (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and fallback sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), selects a platform-specific binary for Linux/macOS/Windows, downloads it over HTTPS with a DNS-TXT chunked-base64 fallback channel, writes it to /var/tmp/.cache<rand> or %TEMP%\dotnetdiag<rand>.exe, sets mode 0755, and spawns it detached via /bin/sh -c or cmd. lib/telemetry.js ships a second copy of the same download-decode-chmod-spawn chain with additional string concatenation obfuscation on the child_process require and chmod call. The hostnames are unrelated to the package's declared purpose, no version pin or hash verification is performed, the binary is staged to a hidden dot-file or a filename impersonating a Microsoft.NET diagnostic tool, and execution is detached to survive the installing process. This fires on any require of the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.3"
            ],
            "import_time": "2026-08-05T09:28:06.252902858Z",
            "sha256": "7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7",
            "modified_time": "2026-08-05T08:44:27Z",
            "id": "IN-MAL-2026-014397",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-auth-provider-interceptor

Package

Name
bigops-auth-provider-interceptor
View open source insights on deps.dev
Purl
pkg:npm/bigops-auth-provider-interceptor

Affected ranges

Affected versions

35.*
35.8.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-GhgbPnR3v83dUX/6dIGmypUwbYuNJzvKDnQuY9QcMsakbA9/17cziG70uC5tGgUiW0J+uAXrJ2ZaYkyj+3uY4g==",
                "sha1": "8556b9e4a81a13deb129efd8eb1c0796b92d7547"
            },
            "filename": "bigops-auth-provider-interceptor-35.8.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_init.js",
            "sha256": "ebc82d537dd721ff3834ac4fa3fcb227526b4b6790ce111f4a9bb2948faabdb7",
            "tlsh": "3aa1b89a06a6b0094bb0d7e4c7178816f65af6633781d284f79c65545f7312083b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "dba1b6a9e60ab3a9df2aaff70ccd3664398824014c8669ef807fa5fee98705d6",
            "tlsh": "81835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-auth-provider-interceptor/MAL-2026-12152.json"