MAL-2026-12855

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-watchdog-angular/MAL-2026-12855.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12855
Published
2026-08-05T15:00:04Z
Modified
2026-08-05T15:50:19.583671656Z
Summary
Malicious code in bigops-watchdog-angular (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d7bfa2b0d9464df6662fddb4e969b42ef35465f2c70ba39943ac3fb0265aa781)

On require() of the package, index.js loads vendor.js which selects a platform-specific URL, downloads an opaque binary from one of several Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache<hex> or %TEMP%\dotnetdiag<hex>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd. Endpoint hostnames are split into fragments and reassembled at runtime via Array.join('') to evade static scanners. No hash or signature verification is performed, the destinations are hardcoded and unrelated to any stated Angular/watchdog purpose, and the staged binaries use disguised cache/diagnostic filenames. The result is arbitrary attacker-controlled code execution on any machine that installs or imports the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015528",
            "import_time": "2026-08-05T15:19:56.192099488Z",
            "sha256": "d7bfa2b0d9464df6662fddb4e969b42ef35465f2c70ba39943ac3fb0265aa781",
            "modified_time": "2026-08-05T15:00:04Z",
            "versions": [
                "35.4.8"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-watchdog-angular

Package

Name
bigops-watchdog-angular
View open source insights on deps.dev
Purl
pkg:npm/bigops-watchdog-angular

Affected ranges

Affected versions

35.*
35.4.8

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-wrHmQJWd2/J6ED+DpHcangfpqn5IfSTs3iZ/+3sBH0QW3N2F243gDvq2vWRwUrNKEGQ0ow0E59hnMBbr+vThbQ==",
                "sha1": "67be344b4bd070cdc1f91d4300e37e856174d2f1"
            },
            "filename": "bigops-watchdog-angular-35.4.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "sha256": "54caad950d3a4b9296ab880e0a154aac7c1938a2987a1ab28ce3b31c82862c67",
            "tlsh": "8aa1876a166670184fb0d7e5c6175816f55bf6533380c6c8fb9c65880fb612482f2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-watchdog-angular/MAL-2026-12855.json"