MAL-2026-12170

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-info-notices/MAL-2026-12170.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12170
Published
2026-08-05T08:44:18Z
Modified
2026-08-05T10:06:03.487412124Z
Summary
Malicious code in bigops-info-notices (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240)

On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers hosts whose hostnames are reconstructed via array-join concatenation (e.g., ["oob-worker.cf99-9","b3.workers",".d","ev"].join("")), writes the payload to a temp path under a disguised name (dotnetdiag*.exe,.cache_*,.analytics_state), chmods it 0755, and detach-executes it via spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) on Unix or spawn("cmd",...) on Windows. A DNS-TXT covert channel over sdk.dl.wel1.ru (also assembled via join) serves as a fallback delivery path, reading a chunk-count TXT record from c.<domain> and reassembling base64 chunks from N.<domain>. The package manifest describes it as an "Internal bigops info notices module for platform services" with a stub API and no dependencies, consistent with a dependency-confusion or typosquat lure whose sole effect on install/require is to drop and execute an attacker-controlled binary.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.9.8"
            ],
            "id": "IN-MAL-2026-014396",
            "import_time": "2026-08-05T09:28:06.137972746Z",
            "modified_time": "2026-08-05T08:44:18Z",
            "source": "amazon-inspector",
            "sha256": "729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-info-notices

Package

Name
bigops-info-notices
View open source insights on deps.dev
Purl
pkg:npm/bigops-info-notices

Affected ranges

Affected versions

35.*
35.9.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-info-notices-35.9.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-xmkPt4uL6UsUBQIKQpqz0eBK1fKgvTaO1FFmmUA+AGxx1zGn/RmxNVeXO+FNTLGx4Cfv/V/pq9VnAOpdowYGKQ==",
                "sha1": "0c5ec96abdf991fccdfb143470bfc77b4eeff722"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "tlsh": "fba1879a0165701d4bb0ebe0c61b8826f65af6633781d294f75ca9984fb3524c371efc",
            "sha256": "feae6e9fabaeeea2fde4c64c517e66ac5f4acba0b44fae73b53721a643843650"
        },
        {
            "path": "index.js",
            "tlsh": "30f02b9e16def972c6b4a3eade620092f95284214f874154be9850ef0ef18100399eba",
            "sha256": "6aa7b2d6d91a1212ec15e1f9746284a4b29bceed92ed1ca11803f3e280f802d5"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-info-notices/MAL-2026-12170.json"