MAL-2026-12155

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-chat-files-hub-client/MAL-2026-12155.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12155
Published
2026-08-05T08:45:09Z
Modified
2026-08-05T10:05:55.687254877Z
Summary
Malicious code in bigops-chat-files-hub-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (77deda11667a4ff5ed546ed7c8279d8cad81eb78b67d9e90208122522b8f681b)

The package's main entry index.js require()s./shim, which on load fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a *.dl.wel1.ru fallback, writes it to a temp path as dotnetdiag<hex>.exe or.cache<hex>, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed at runtime from split string fragments joined with.join("") to hide them from static inspection. A second dropper module lib/telemetry.js (81 KB) ships in the tarball with the same base64-chunk decode + spawn + chmod 0755 mechanics wrapped in Sentry-like class names; it is not on the reachable require() graph in this version but is present for future activation. Telemetry-themed filenames and opt-out env vars (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOT_TRACK) provide cover. The stated purpose (chat files hub client) has no legitimate need to fetch and execute native binaries from anonymous edge-worker hosts.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014402",
            "import_time": "2026-08-05T09:28:06.747213813Z",
            "sha256": "77deda11667a4ff5ed546ed7c8279d8cad81eb78b67d9e90208122522b8f681b",
            "modified_time": "2026-08-05T08:45:09Z",
            "versions": [
                "35.4.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-chat-files-hub-client

Package

Name
bigops-chat-files-hub-client
View open source insights on deps.dev
Purl
pkg:npm/bigops-chat-files-hub-client

Affected ranges

Affected versions

35.*
35.4.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-goR6I+ZQnTB3nqmGRPpJW5Kdio+UmNHlP4kq6N2hZsBJ65G9IrMdzO7dWOblGWhw76GDt5aHvGBEeyHh+ot17g==",
                "sha1": "a73b87a5c2d1e9b7eee0867d38d3ac1f8d9a41ac"
            },
            "filename": "bigops-chat-files-hub-client-35.4.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_shim.js",
            "sha256": "7e62d09ed5bf383f9df485bcff090729f11d5e7b2754ef885668629b9190f70c",
            "tlsh": "79b197aa016670184770dbe4c7175415f65bf66373809294fb9ca5881fb2224c3b3efc"
        },
        {
            "sha256": "947f074127d6d5b1e888800fe84b044836e4b6690050e5a41db56088b4470ebf",
            "path": "lib/telemetry.js",
            "tlsh": "1c835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-chat-files-hub-client/MAL-2026-12155.json"