MAL-2026-13230

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-operator-status/MAL-2026-13230.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13230
Published
2026-08-05T15:36:48Z
Modified
2026-08-05T16:50:03.672961934Z
Summary
Malicious code in bigops-operator-status (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a)

On require() of this package, index.js loads support.js which selects a platform-specific asset path (linux/darwin/windows), fetches a binary payload from one of four Cloudflare Workers hostnames whose strings are assembled at runtime from split arrays to evade static analysis (oob-worker.cf102-baf.workers.dev, cf99-9b3, cf103-070, cf101-adf), writes the bytes to a disguised path under /tmp or the Windows Temp directory (e.g. dotnetdiag_*.exe,.cache_*), chmods 0755, and spawns the resulting binary detached via /bin/sh -c or cmd. If HTTPS retrieval fails, _support.js falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it resolves c.<domain> for a chunk count, then queries 0.<domain>..N.<domain>, base64-decodes the concatenated TXT contents into a binary, and executes it the same way. The destinations are not publisher-controlled, the payload bytes are opaque, and the hosts are obfuscated by string splitting — the shape is a full-host remote code execution dropper triggered at module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:36:48Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015766",
            "import_time": "2026-08-05T16:13:42.784056923Z",
            "sha256": "0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a",
            "versions": [
                "35.4.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-operator-status

Package

Name
bigops-operator-status
View open source insights on deps.dev
Purl
pkg:npm/bigops-operator-status

Affected ranges

Affected versions

35.*
35.4.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-operator-status-35.4.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-I16kfWyXeOvAtIfaoIFz5umMsD+WfaCyiWPBhI6/wPjeF6aIzJXt4NpZeOI/mzmLDG1J043g6G9J8J1WCQEcyQ==",
                "sha1": "93d4d4449aaee5e31e51894304368b406f6eafa3"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "52b1a896126a70184b70e7e4c7178825f55af6a33781c298fb5c65844f77124c3b2efc",
            "sha256": "ac7169be0e69fe6e5fe9567a8c738baf7c152ac4a4d4f357f9ba25900c6e15ed",
            "path": "_support.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-operator-status/MAL-2026-13230.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]