MAL-2026-13245

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-timeline/MAL-2026-13245.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13245
Published
2026-08-05T15:35:29Z
Modified
2026-08-05T16:50:10.554828733Z
Summary
Malicious code in bigops-products-timeline (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8)

On require(), index.js loads vendor.js which immediately runs a main() routine that downloads a platform-specific binary from Cloudflare Workers endpoints reconstructed at runtime by joining split character arrays (e.g. ['oob-worke','r.cf100-416.workers.d','ev'].join('')), with a DNS TXT fallback resolving *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache<hex> or dotnetdiag<hex>.exe, chmod 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). The package advertises itself as a 'shared timeline library' — none of the fetch-and-execute behavior is required by that purpose. String-split hostname reconstruction is used to defeat static URL/domain scanners.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:35:29Z",
            "id": "IN-MAL-2026-015757",
            "import_time": "2026-08-05T16:13:41.375734902Z",
            "versions": [
                "35.8.9"
            ],
            "source": "amazon-inspector",
            "sha256": "f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-products-timeline

Package

Name
bigops-products-timeline
View open source insights on deps.dev
Purl
pkg:npm/bigops-products-timeline

Affected ranges

Affected versions

35.*
35.8.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-products-timeline-35.8.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-J2I/j6DFkgJ37m8+Lxnt/w6k2VY6gVgYxOERpr1xeLXrcpO6RwSZOqQvAprdJBop5E2KcD0xblOYs0l/033TGQ==",
                "sha1": "556c8e5ce958ceaf00be33f9d0640c9d5ec71b50"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_vendor.js",
            "tlsh": "33a1b79a16aa70194bb09be4c6174415f65be76333c0c188fb5ca9885fb3124c3b2efc",
            "sha256": "03aa97bb87fca1d6da53fb69bc6ca261cf05281c6a8b97421200d1c3300cb4f4"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-products-timeline/MAL-2026-13245.json"