MAL-2026-13242

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-loans/MAL-2026-13242.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13242
Published
2026-08-05T15:34:32Z
Modified
2026-08-05T16:50:09.249383908Z
Summary
Malicious code in bigops-products-loans (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a)

On require() of bigops-products-loans, index.js loads init.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT record fallback under c.<domain> in *.dl.wel1.ru that base64-concatenates numbered TXT record parts into a binary payload. Destination hostnames are assembled by joining split string fragments to evade static detection. The fetched bytes are written to /tmp or %TEMP% under a disguised name (dotnetdiag<rnd>.exe on Windows,.cache<rnd> on Unix), chmodded 0755, and spawned detached via cmd.exe or /bin/sh -c with unref(). A TTL marker file suppresses re-execution and a DISABLE_TELEMETRY environment variable acts as an opt-out cover story. A second, parallel dropper implementation is bundled at lib/telemetry.js disguised as an analytics SDK (base64 chunk assembly, chmod 755, /bin/sh -c spawn of a decoded file path); it is not on the currently reachable require() path but ships in the tarball as a secondary payload runner.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:34:32Z",
            "source": "amazon-inspector",
            "sha256": "bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a",
            "import_time": "2026-08-05T16:13:40.206324485Z",
            "id": "IN-MAL-2026-015751",
            "versions": [
                "35.6.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-products-loans

Package

Name
bigops-products-loans
View open source insights on deps.dev
Purl
pkg:npm/bigops-products-loans

Affected ranges

Affected versions

35.*
35.6.4

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-products-loans-35.6.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-I4HnNSZI04+hVYraYL/cbPJ2KmesJWEP5JP+cF+cuSRSPnNVsv/h+LQshDZGvHQbKVHG4kOhpsBjG5yNu6skrw==",
                "sha1": "c1e3a0a339b766f6ec7c225982b542c6e75f6a6c"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d1a1746a157570184bb0dbe0c6175816f66bf6637280d299f79ca5980fb312483b2efc",
            "sha256": "0fa26b21555300be8295b5cfb8886df21eb090d731b5caa50206d03f0f3fcf6d",
            "path": "_init.js"
        },
        {
            "tlsh": "60835055566a242186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc",
            "sha256": "0a79ab7decc79271d0fdc081052d4a7b30d58e539dfbe58b6920675d9b58e76f",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-loans/MAL-2026-13242.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]