MAL-2026-12166

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-figma-to-html/MAL-2026-12166.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12166
Published
2026-08-05T08:47:13Z
Modified
2026-08-05T10:06:01.809151869Z
Summary
Malicious code in bigops-figma-to-html (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c9d43dbcd2d43f28af8266fac2d7e08a782dfbaaac1d02375438095a8001b24e)

On require, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint, fetches an opaque binary from author-controlled Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) with a DNS-TXT chunked fallback over *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru), writes it to /var/tmp/.cache<hex> on POSIX or %TEMP%\dotnetdiag<hex>.exe on Windows, chmods 0755, and spawns it detached and unref'd via /bin/sh -c or cmd. Destination hostnames are constructed at runtime by joining split-string fragments (e.g. ["oob-wo","rker.cf103-070.worke","rs.de","v"].join("")) to hide them from static scanners. The DNS-TXT fallback retrieves a chunk count from c.<domain> and reassembles base64 chunks from N.<domain>, providing a covert delivery channel that bypasses HTTPS egress filtering. No hash or signature verification is performed; filenames impersonate dotnet diagnostics artifacts; opt-out is only via undocumented environment variables.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:47:13Z",
            "id": "IN-MAL-2026-014416",
            "import_time": "2026-08-05T09:28:08.755427646Z",
            "sha256": "c9d43dbcd2d43f28af8266fac2d7e08a782dfbaaac1d02375438095a8001b24e",
            "versions": [
                "35.5.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-figma-to-html

Package

Name
bigops-figma-to-html
View open source insights on deps.dev
Purl
pkg:npm/bigops-figma-to-html

Affected ranges

Affected versions

35.*
35.5.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-figma-to-html-35.5.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-EoYsMxQJ8km02r5rJRakz30jgyfQ+KgGfIljSetWh+X8Vx3389XOdsYvRbYsxtjfu1RM5DbrcvVdp6Eoounc5A==",
                "sha1": "cab47fa892437c4cc042c7920828ad90ba734dff"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "82a1969a16a670198f70d7e487174416f66be6633280c2d4f75ca9941fb613483b2efc",
            "sha256": "a3a85a7652f9fc27ad41f2eab3db23a0241f35791fbea267c296f4d524b91d6a",
            "path": "_bootstrap.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-figma-to-html/MAL-2026-12166.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]