🛡️ MAL-2026-12151 — bigops-auth-interceptor

Malicious code in bigops-auth-interceptor (npm)

Source: amazon-inspector

On require() of [email protected], index.js loads _vendor.js which selects a platform-specific binary URL, downloads bytes over HTTPS from one of four string-concatenation-obfuscated Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), writes them to a temp path under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Linux), chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe. A DNS TXT-record fallback channel (c.<domain> returns a chunk count, then i.<domain> TXT records are concatenated and base64-decoded into the payload) is implemented against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, providing covert payload retrieval when HTTPS is blocked. A run-once marker file (.analytics_state) prevents repeated execution. Destination hosts are unrelated to any legitimate publisher of the package's stated purpose; the fetched bytes are unpinned, unsigned, and platform-selected.