MAL-2026-13243

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-mobile/MAL-2026-13243.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13243
Published
2026-08-05T15:35:00Z
Modified
2026-08-05T16:50:09.276485132Z
Summary
Malicious code in bigops-products-mobile (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (265e87afdb04434bf53739963fd1c91ddb80c8ac957384377898c0aaf87cf826)

On require('bigops-products-mobile'), index.js loads loader.js which selects a platform-specific binary path, fetches attacker-controlled bytes over HTTPS from obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) reconstructed at runtime by joining fragmented string arrays, with a DNS-TXT chunked fallback under *.dl.wel1.ru. The bytes are written to a disguised path ('.cache<hex>' on POSIX, 'dotnetdiag<hex>.exe' on Windows to impersonate a Microsoft diagnostic tool), chmod 0755'd, and detach-spawned via /bin/sh -c or cmd.exe with stdio ignored and unref()'d. No hash or signature verification is performed, the package's declared purpose ('device integration') has no dependencies and no relation to this behavior, and a persistence stamp is written to '.analyticsstate' with telemetry/analytics-styled comments and DISABLETELEMETRY/DONOTTRACK env checks used as cover. lib/telemetry.js ships a second, structurally identical fetch->base64->chmod 755->/bin/sh spawn dropper implementation (not currently wired from index.js but present in the tarball). Installing and importing this package yields remote code execution on the installer's host under attacker control.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:35:00Z",
            "id": "IN-MAL-2026-015754",
            "import_time": "2026-08-05T16:13:40.724314282Z",
            "versions": [
                "35.6.8"
            ],
            "source": "amazon-inspector",
            "sha256": "265e87afdb04434bf53739963fd1c91ddb80c8ac957384377898c0aaf87cf826"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-products-mobile

Package

Name
bigops-products-mobile
View open source insights on deps.dev
Purl
pkg:npm/bigops-products-mobile

Affected ranges

Affected versions

35.*
35.6.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-mobile/MAL-2026-13243.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-products-mobile-35.6.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-Q4h66LTxHLxabX06WPu2CJQJD3JLujobVFyadAJuToP1NlnKduEzu3TkoTP8KKjgHUWuy9xBHeVa3yr9u4mYgw==",
                "sha1": "d8f99c306ecee8b04d58fc76375d1fa7528dd6aa"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_loader.js",
            "tlsh": "3db1b89a16aa71184bb0a7e4c7175416f65af2633380c6d4f75ca9981fb313483b2efc",
            "sha256": "778d82c74ab2eecb2133923cfb62c446c6d0266df9d477ecb7cfd76120bedbd4"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "cf835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc",
            "sha256": "d882fd8646cfdbd06df8c1fa3131de6b9d1b0b3a853ccd9dcdfbb6189faaf3a7"
        }
    ]
}