🛡️ MAL-2026-13244 — bigops-products-savings-accounts

Malicious code in bigops-products-savings-accounts (npm)

Source: amazon-inspector

On require() of bigops-products-savings-accounts, _ext.js reconstructs C2 hostnames via Array.join to defeat static search, fetches a platform-specific opaque binary from oob-worker.cf101-adf.workers.dev (with a DNS-TXT chunked-base64 fallback resolver via sdk.dl.wel1.ru), writes it to /var/tmp/.cache_<hex> on Linux or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or spawn("cmd",...). lib/telemetry.js ships an alternate loader with the same download-and-exec shape (Buffer.from(chunks,'base64'), cp.spawn('/bin/sh',['-c',filePath+' &']), fs['chmod'+'Sync'](...,0o755)) under an 'Analytics SDK' cover story. Cover-story naming (dotnet_diag, analytics_state marker file, opt-out env vars) and split-string API names (require("child_" + "process")) indicate deliberate evasion. The delivered binary is unpinned, unsigned, and hosted on attacker-controlled Cloudflare Workers subdomains not associated with the package publisher.