🛡️ MAL-2026-13237 — bigops-products-accounts-and-cards

Malicious code in bigops-products-accounts-and-cards (npm)

Source: amazon-inspector

On require of this package, index.js loads _shim.js which selects a platform-specific binary, downloads it over HTTPS from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev and sibling *.workers.dev endpoints), writes it to a temp path under a disguised filename (dotnet_diag_*.exe /.cache_*), sets it executable via chmodSync 0o755, and detached-spawns it through /bin/sh -c or cmd. A DNS TXT-record base64 channel to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru provides a fallback delivery path. A second fully-formed dropper is shipped as lib/telemetry.js under an 'analytics SDK' cover story, implementing the same base64-assembled payload plus spawn('/bin/sh',['-c', filePath+' &']) pattern with string-concatenated API names (fs['chmod'+'Sync']). Hostnames and dangerous API identifiers are assembled at runtime via array joins to evade static analysis. Any consumer that imports the package receives arbitrary attacker-controlled code execution on their machine.