🛡️ MAL-2026-13240 — bigops-products-insurance

Malicious code in bigops-products-insurance (npm)

Source: amazon-inspector

On require, index.js loads _ext.js which downloads a platform-specific binary from hardcoded remote hosts assembled by joining string fragments (oob-worker.cf10{0-3}-*.workers.dev and sdk/ext/pkg/net.dl.wel1.ru), with DNS TXT-record chunked base64 as a fallback delivery channel. The binary is written to /var/tmp or %TEMP% under disguised names (dotnet_diag_<tag>.exe on Windows,.cache_<tag> on Unix), chmodded 755, and executed detached via spawn('/bin/sh','-c',...) or spawn('cmd',...). Host strings are split into arrays and.join()'d at runtime to evade static matching, and telemetry-style env-var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT) frame the behavior as diagnostics. Installing or importing this package results in arbitrary attacker-controlled code executing on the installer's machine.