MAL-2026-12161

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-communication-client/MAL-2026-12161.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12161
Published
2026-08-05T08:46:04Z
Modified
2026-08-05T10:05:59.095310544Z
Summary
Malicious code in bigops-communication-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (81c94eee2da1d74fc50236452fc79165eb1183ce0bb874a62a9a7985b6e77206)

On require() of the package, index.js loads platform.js which invokes init() at module top level. init() downloads an opaque binary from Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, cf100-416, cf103-070, cf99-9b3.workers.dev) whose hostnames are reconstructed at runtime via array-join to evade static string scanners, with a DNS TXT covert channel (chunked base64 payload retrieved from sdk.dl.wel1.ru) as fallback. The fetched bytes are written to /tmp or %TEMP% under names impersonating.NET diagnostic tools (dotnetdiag<tag>.exe,.cache<tag>), chmod 0755 on Unix, then spawned detached via /bin/sh -c or cmd.exe start /b with stdio ignored. Anti-analysis logic aborts execution if DISABLETELEMETRY / ANALYTICSOPTOUT / DONOTTRACK are set and stamps /tmp/.analyticsstate to skip re-execution for ~22438 seconds, framing the dropper as telemetry. There is no legitimate purpose for a require()-time fetch-and-execute of an unpinned, unverified binary from anonymous Workers hosts with runtime host reconstruction and a DNS-TXT payload channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T09:28:07.591391241Z",
            "versions": [
                "35.8.8"
            ],
            "modified_time": "2026-08-05T08:46:04Z",
            "source": "amazon-inspector",
            "sha256": "81c94eee2da1d74fc50236452fc79165eb1183ce0bb874a62a9a7985b6e77206",
            "id": "IN-MAL-2026-014408"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-communication-client

Package

Name
bigops-communication-client
View open source insights on deps.dev
Purl
pkg:npm/bigops-communication-client

Affected ranges

Affected versions

35.*
35.8.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-tn+Asiu3UiPKfhkty5x7iY1e8OlequfTFFYmaTOwrHEuIaX10FlxJ7qZqWDSQZeDFHXam7XukSgcHd/EZbp8hA==",
                "sha1": "545e6574625dd35eea3fee3226da246a634f5c30"
            },
            "filename": "bigops-communication-client-35.8.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "afa1b65612aa70194bb0e7e4cb1b8419f55bf66337808294fb9ca5d45f7342483b2efc",
            "sha256": "b5abc7815482d1233705fe6ac602f0cfe50fcca26394ed9d45066986597d1591",
            "path": "_platform.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-communication-client/MAL-2026-12161.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]