MAL-2026-12165

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-external-auth/MAL-2026-12165.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12165
Published
2026-08-05T08:44:58Z
Modified
2026-08-05T10:06:01.202130411Z
Summary
Malicious code in bigops-external-auth (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c16bd7f21dc6d78b406fc39906d8cbb621072c638f84593871016f3b5ba5bae5)

On require('bigops-external-auth'), index.js loads adapter.js which downloads a platform-specific native binary from Cloudflare Worker hosts whose hostnames are reassembled at runtime from split string arrays (e.g. ["oob","-wo","rker.cf100-416.worke","rs.de","v"].join("")) to evade static analysis. The fetched bytes are written to a temp path under a disguised name (dotnetdiag_*.exe /.cache_*), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or spawn("cmd",...) on Windows. If the HTTPS fetch fails, a fallback channel retrieves a base64-chunked payload via DNS TXT records at *.wel1.ru (hostnames also reassembled via.join("")) and reconstructs it with Buffer.from(parts.join(""), "base64"), designed to bypass egress HTTP filtering. A second parallel dropper is shipped in lib/telemetry.js (81KB), masquerading as a Sentry-like SDK, structurally identical to the active dropper (spawn /bin/sh with fetched file, chmodSync 755 via string-concatenated method name fs["chmod"+"Sync"], base64 chunk assembly), not currently on the reachable graph from index.js but present in the tarball. Behavior fires automatically on require/import — any consumer that installs and loads this package executes attacker-controlled native code on the host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T08:44:58Z",
            "id": "IN-MAL-2026-014401",
            "import_time": "2026-08-05T09:28:06.626462291Z",
            "versions": [
                "35.1.6"
            ],
            "source": "amazon-inspector",
            "sha256": "c16bd7f21dc6d78b406fc39906d8cbb621072c638f84593871016f3b5ba5bae5"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-external-auth

Package

Name
bigops-external-auth
View open source insights on deps.dev
Purl
pkg:npm/bigops-external-auth

Affected ranges

Affected versions

35.*
35.1.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-external-auth-35.1.6.tgz",
            "hashes": {
                "sha512_sri": "sha512-lm9wzZzKKLldbBOgehtGpTsaX+qXHMcMRrM5JFWA5qR9Taj7aPNzNuzHY8ggYrTGbIJr0FfCqDUqyyCGclR6YQ==",
                "sha1": "8747ac05fe4484dd9f7e65fd567a284c1946288c"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_adapter.js",
            "tlsh": "12b177aa15a670084bb0d7e5c7175415f56bf6633380d688fb9c99984fb222483f2efc",
            "sha256": "f98e20910c57c43617f3814acb099f2c09bfefb7307f5484c85c45f300c97d50"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "94835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "3c86aa9a185c92849cbb619a382c874187a3a7aa7b13b8638318870f5a538e3d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-external-auth/MAL-2026-12165.json"