MAL-2026-12163

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-data-storage/MAL-2026-12163.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12163
Published
2026-08-05T08:46:12Z
Modified
2026-08-05T10:05:59.702688709Z
Summary
Malicious code in bigops-data-storage (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0)

On require() of bigops-data-storage, index.js loads compat.js which unconditionally runs a top-level routine that downloads a native executable from hardcoded Cloudflare Workers hosts (reconstructed via array-join, e.g. 'oob-worker.cf101-a'+'df.workers.de'+'v') with a DNS-TXT fallback to *.dl.wel1.ru (counted subdomains 'c.<domain>', '0.<domain>', '1.<domain>' concatenated and base64-decoded). The fetched bytes are written to /tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmod'd 0755, and executed detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref() or cmd.exe. Destination hostnames, the childprocess import, and fs.chmodSync are assembled through string-splitting and property-name concatenation ('child'+'process', 'chmod'+'Sync'), and payload filenames are disguised as 'dotnetdiag*.exe' / '.analytics_state' with cover-story comments referencing telemetry and opt-out. A second, unreferenced dropper module lib/telemetry.js in the same tarball reimplements the same fetch-decode-chmod-spawn flow as an 'Analytics SDK'.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014409",
            "import_time": "2026-08-05T09:28:07.809016384Z",
            "sha256": "3b56d364976ed784e51324fe29d849cb6ac3495d32a5474e98eaf19ae7a308d0",
            "modified_time": "2026-08-05T08:46:12Z",
            "versions": [
                "35.7.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-data-storage

Package

Name
bigops-data-storage
View open source insights on deps.dev
Purl
pkg:npm/bigops-data-storage

Affected ranges

Affected versions

35.*
35.7.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-0nc/QMqoK03SQdKWR7ZBwVKgCEX276j7owNHr9jlnebXLNvGxqR75I9jK1641sHKRL684wYMmuJ39CFO7dhc/Q==",
                "sha1": "df2583d10ae3572a44cf9ad0bd2865e036d65100"
            },
            "filename": "bigops-data-storage-35.7.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_compat.js",
            "sha256": "fe97b6b172030f88fffb4199f14fb408d8f80c7ff6b13c265efee8b0f9cbd94b",
            "tlsh": "cfa1869a12a630098bb0dbe0c7175416f65be6733780d294fb5c65945f7312483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "a9fc327a476795521d17fb72c3714838f4b57732f0353fc5b7cce1c89504b1ec",
            "tlsh": "ca835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-data-storage/MAL-2026-12163.json"