MAL-2026-13250

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-statements-timeline/MAL-2026-13250.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13250
Published
2026-08-05T15:34:01Z
Modified
2026-08-05T16:50:13.171213492Z
Summary
Malicious code in bigops-statements-timeline (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d10168eeae00c6455a6a5a4838aa1afc9460a1edbc287d0b6f8b4acab5eae316)

On require() of the package, index.js loads support.js which selects a platform-specific asset path and downloads a binary over HTTPS from a rotating list of anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT chunked-base64 fallback under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names (analyticsstate, dotnetdiag*), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames and fallback DNS domains are reconstructed at runtime from split string fragments joined via Array.join to defeat static analysis. Installing or requiring this package results in execution of arbitrary attacker-controlled native code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:34:01Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015748",
            "import_time": "2026-08-05T16:13:39.819636773Z",
            "sha256": "d10168eeae00c6455a6a5a4838aa1afc9460a1edbc287d0b6f8b4acab5eae316",
            "versions": [
                "35.2.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-statements-timeline

Package

Name
bigops-statements-timeline
View open source insights on deps.dev
Purl
pkg:npm/bigops-statements-timeline

Affected ranges

Affected versions

35.*
35.2.4

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-statements-timeline-35.2.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-4qbSiEFdqmeX4yHLcTFHxPc/qPn4sAgi7Bn8aLJAE+4U5aaK9Rt+zYojg1G0Yt6gB88J7MvxPQ5M54wztHFNkg==",
                "sha1": "c5f002e9f5cf3054a02029374d0f97c0def3a471"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "72a1855a16a670188bb09bf4c7274815f65af663378082c4f75ca5945fb713483b2efc",
            "sha256": "c09c96a954663f56813f44b9d3e198fc7c7e8c3c2dd11ccd171a9634fa77b2ed",
            "path": "_support.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-statements-timeline/MAL-2026-13250.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]