MAL-2026-12158

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-chats-client/MAL-2026-12158.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12158
Published
2026-08-05T08:44:08Z
Modified
2026-08-05T10:05:56.701877910Z
Summary
Malicious code in bigops-chats-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eb764a83c5f69d414a640397df2acd34a25e83c8829a63040046661fd4e33a69)

On require() of the package, index.js loads init.js which performs OS/arch detection, downloads a native binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes it to a temp path with a masqueraded filename (e.g. dotnetdiag_*.exe,.cache_*), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. C2 hostnames are assembled at runtime from arrays of substrings joined together to evade static string search. If HTTPS retrieval fails, init.js falls back to a DNS-TXT covert channel under *.dl.wel1.ru sub-zones (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru): it resolves c.<domain> to obtain a chunk count, resolves <i>.<domain> for each chunk, base64-decodes the concatenated payload, writes it to disk and executes it. A cache flag (.analyticsstate) is used to run once per TTL. The package advertises itself as a chats client SDK; there is no legitimate reason for such a package to fetch and execute an opaque native binary at load time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T08:44:08Z",
            "source": "amazon-inspector",
            "sha256": "eb764a83c5f69d414a640397df2acd34a25e83c8829a63040046661fd4e33a69",
            "import_time": "2026-08-05T09:28:06.000343081Z",
            "id": "IN-MAL-2026-014395",
            "versions": [
                "35.2.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-chats-client

Package

Name
bigops-chats-client
View open source insights on deps.dev
Purl
pkg:npm/bigops-chats-client

Affected ranges

Affected versions

35.*
35.2.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-chats-client/MAL-2026-12158.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-chats-client-35.2.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-iMd3wN2skR+2bQELQsjFaL92f5NowdRgd58xGOYv3jZcrv1i6NxUZK8FPJuhDF7FHznBG0bj0+WtnSb8I3i0jw==",
                "sha1": "dd9026da276d9cf634d668115be6e0542b1c7ab4"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "27a1975a12aa71198bb0ebe5c6174416f65bf6633280c5c4fbac69844f73124c3b2dfc",
            "sha256": "823f0880ed51ee7b1d793e9524e0d54bc042a43776532f4f262ba00ef1d83519",
            "path": "_init.js"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]