🛡️ MAL-2026-13220 — bigops-jsonpath-mapper

Malicious code in bigops-jsonpath-mapper (npm)

Source: amazon-inspector

On require of bigops-jsonpath-mapper, index.js loads _bridge.js which assembles hostnames from string-array joins to hide the destinations (oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev, with DNS-TXT chunked-base64 fallback to *.dl.wel1.ru), fetches a platform-specific native binary over HTTPS, writes it to /tmp or %TEMP% under disguised names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods 0755 on Unix, and spawns it detached and unref'd via spawn("/bin/sh",...) or spawn("cmd",...). A /tmp/.analytics_state TTL file suppresses re-execution across imports. Comments frame the behavior as telemetry/session tracking, but the shipped code is a fetch-and-execute dropper of opaque bytes from author-controlled non-publisher infrastructure that runs at module load time.