MAL-2026-13228

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-offers/MAL-2026-13228.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13228
Published
2026-08-05T15:37:11Z
Modified
2026-08-05T16:50:02.275583776Z
Summary
Malicious code in bigops-offers (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5)

bigops-offers@35.6.8 executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arrays (workers.dev subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) and fetches a platform-specific binary via https.get. A DNS TXT-record fallback assembles base64 payload chunks from c.dl.wel1.ru and 0..N.dl.wel1.ru (sdk/ext/pkg/net subdomains). The retrieved bytes are written to a disguised path (dotnetdiag<rand>.exe on Windows,.cache<rand> on Unix), chmod 0o755, and spawned detached via /bin/sh or cmd. A.analyticsstate lock file and DISABLETELEMETRY/DONOT_TRACK env checks provide a telemetry cover story. Destinations, filenames, and delivery channels are string-split to evade static detection.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:37:11Z",
            "sha256": "422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5",
            "import_time": "2026-08-05T16:13:43.109907247Z",
            "id": "IN-MAL-2026-015768",
            "versions": [
                "35.6.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-offers

Package

Name
bigops-offers
View open source insights on deps.dev
Purl
pkg:npm/bigops-offers

Affected ranges

Affected versions

35.*
35.6.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-offers-35.6.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-RiqQbscpUDA2NLg6dxbKVK64xl1Jyhu4wOPYS7121K1YyrWJIAmdu3noB/gjb0aJlDzzo9elOah0yRktQWnOGw==",
                "sha1": "f1f1027120120fbfd73719f699ea19f940cb67d9"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "a5a1969a0266701987b0dbe48b175416f66be66333c0c6c4fb6c69841f7312483b2efc",
            "sha256": "e14fd81ab62a957ed4d24051f5f930b796032f820920b7a10df74c300261bef0",
            "path": "_init.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-offers/MAL-2026-13228.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]