🛡️ MAL-2026-13227 — bigops-notes

Malicious code in bigops-notes (npm)

Source: amazon-inspector

On require() of bigops-notes, _bootstrap.js selects a platform-specific asset, downloads an opaque binary from one of four runtime-assembled *.workers.dev hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT base64 fallback to *.dl.wel1.ru (sdk/ext/pkg/net). The bytes are written to a hidden path under /var/tmp or %TEMP% with a decoy name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd. Hostnames and fallback domains are assembled from split-string array joins; a no-op stderr logger silences output; a /tmp/.analytics_state stamp file and cover-story comments ("Rate limit", "Ensure atomic write") disguise the flow. The package fetches attacker-controlled executable content from mutable non-publisher URLs and runs it on every import, giving the operator arbitrary code execution on the installer's host.