🛡️ MAL-2026-13223 — bigops-logs-player

Malicious code in bigops-logs-player (npm)

Source: amazon-inspector

On require() of bigops-logs-player, index.js loads _polyfill.js, which reconstructs a list of Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) from split string fragments to hide them from static scanners. It downloads an OS-specific native binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0o755, and spawns it detached through /bin/sh or cmd.exe. A DNS-TXT covert-channel fallback resolves alternate hosts under *.dl.wel1.ru (also assembled from split fragments). A freshness marker and environment opt-outs gate execution to reduce noise. The package advertises itself as a log-transport library; fetching and executing a native binary from obfuscated attacker-controlled infrastructure has no relation to that purpose.