MAL-2026-13237

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-accounts-and-cards/MAL-2026-13237.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13237
Published
2026-08-05T15:34:51Z
Modified
2026-08-05T16:50:06.456591769Z
Summary
Malicious code in bigops-products-accounts-and-cards (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dfef5ead75c58c24a4fc31b418af20b6252ac9177785002ccbf49407a28dddd8)

On require of this package, index.js loads shim.js which selects a platform-specific binary, downloads it over HTTPS from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev and sibling *.workers.dev endpoints), writes it to a temp path under a disguised filename (dotnetdiag_*.exe /.cache_*), sets it executable via chmodSync 0o755, and detached-spawns it through /bin/sh -c or cmd. A DNS TXT-record base64 channel to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru provides a fallback delivery path. A second fully-formed dropper is shipped as lib/telemetry.js under an 'analytics SDK' cover story, implementing the same base64-assembled payload plus spawn('/bin/sh',['-c', filePath+' &']) pattern with string-concatenated API names (fs['chmod'+'Sync']). Hostnames and dangerous API identifiers are assembled at runtime via array joins to evade static analysis. Any consumer that imports the package receives arbitrary attacker-controlled code execution on their machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015753",
            "import_time": "2026-08-05T16:13:40.488987453Z",
            "sha256": "dfef5ead75c58c24a4fc31b418af20b6252ac9177785002ccbf49407a28dddd8",
            "versions": [
                "35.7.5"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:34:51Z"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-products-accounts-and-cards

Package

Name
bigops-products-accounts-and-cards
View open source insights on deps.dev
Purl
pkg:npm/bigops-products-accounts-and-cards

Affected ranges

Affected versions

35.*
35.7.5

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-accounts-and-cards/MAL-2026-13237.json"
indicators 
{
    "evidence_files": [
        {
            "path": "_shim.js",
            "tlsh": "d1b1975a129a71188bb097e4c7174416f65bf6633780c6c4f79ca5881fb352483b2efc",
            "sha256": "4bc926818b5cdbc067deb518289397752002436f03601e796f1aeae529391294"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "53835055566a242186b2b368df234007ff3685272643429dbafc82dc1fbd72092a5ffd",
            "sha256": "772972769240cc7dd8fcf53089ee3bcbe0b926c9d08549ee00d50b0d7ac74a09"
        }
    ],
    "package_integrity": [
        {
            "filename": "bigops-products-accounts-and-cards-35.7.5.tgz",
            "hashes": {
                "sha1": "330b844a49aecfe1246b4078c4ce2b75b3769370",
                "sha512_sri": "sha512-Tn1xK5jj29Epyj5fwsICMjbqi3ysUVKRqH/V+vRCrAJKZZFUY/TJwMjf9vO8mAgpitA9C7onaGSdmJq5H3RrLA=="
            }
        }
    ]
}