MAL-2026-13232

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-plugin-notification-builder/MAL-2026-13232.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13232
Published
2026-08-05T15:36:31Z
Modified
2026-08-05T16:50:04.004877691Z
Summary
Malicious code in bigops-plugin-notification-builder (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (829800a4393389fef48ff06ea586a4892215acc428700193652bd1f3ce3f71b0)

On require()/import, index.js unconditionally loads bridge.js, which fetches a platform-specific binary from hardcoded, string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) and, on HTTPS failure, reassembles the payload from base64-encoded DNS TXT chunks under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to a disguised temp path (dotnetdiag<uid>.exe /.cache<uid>), chmod 0755'd, and spawned detached via spawn("/bin/sh",...) or spawn("cmd",...). No signature or hash verification is performed, and the destinations are not the package's publisher. Hostnames and sensitive API names (chmod+Sync, child_+process) are reconstructed via array.join("") splitting to evade static analysis. A parallel copy of the same dropper primitives ships in lib/telemetry.js under an 'analytics SDK' cover story.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:36:31Z",
            "sha256": "829800a4393389fef48ff06ea586a4892215acc428700193652bd1f3ce3f71b0",
            "import_time": "2026-08-05T16:13:42.627321655Z",
            "id": "IN-MAL-2026-015764",
            "versions": [
                "35.1.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-plugin-notification-builder

Package

Name
bigops-plugin-notification-builder
View open source insights on deps.dev
Purl
pkg:npm/bigops-plugin-notification-builder

Affected ranges

Affected versions

35.*
35.1.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-plugin-notification-builder-35.1.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-PuwEh+ItJI+2EVsnyXLrffRKr0SEZem/eLtFv7Zhm0pgi5/eIzHcjVJbR9ov29441rrSYygKjoqvznECcnxRTw==",
                "sha1": "ba4b52eb64878f1e694c401831189b47bb724ae2"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "42a196aa16a670194bb09be4c7174416f65be6633380c2d8fb5ca5880f7712483b2efc",
            "sha256": "8f13df4bb237eae65573bcce517f30700ec9e58f16ad169f1fd9299c4acc2e02",
            "path": "_bridge.js"
        },
        {
            "tlsh": "c1835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "216d15e91eb4a2935cbf618e6388c60a687cd354230e86e312effb474c17019e",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-plugin-notification-builder/MAL-2026-13232.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]