{"schema_version":"1.8.0","id":"MAL-2026-13230","published":"2026-08-05T15:36:48Z","modified":"2026-08-05T16:50:03.672961934Z","summary":"Malicious code in bigops-operator-status (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a)\nOn require() of this package, index.js loads _support.js which selects a platform-specific asset path (linux/darwin/windows), fetches a binary payload from one of four Cloudflare Workers hostnames whose strings are assembled at runtime from split arrays to evade static analysis (oob-worker.cf102-baf.workers.dev, cf99-9b3, cf103-070, cf101-adf), writes the bytes to a disguised path under /tmp or the Windows Temp directory (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755, and spawns the resulting binary detached via /bin/sh -c or cmd. If HTTPS retrieval fails, _support.js falls back to a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it resolves c.<domain> for a chunk count, then queries 0.<domain>..N.<domain>, base64-decodes the concatenated TXT contents into a binary, and executes it the same way. The destinations are not publisher-controlled, the payload bytes are opaque, and the hosts are obfuscated by string splitting — the shape is a full-host remote code execution dropper triggered at module load.\n","affected":[{"package":{"name":"bigops-operator-status","ecosystem":"npm","purl":"pkg:npm/bigops-operator-status"},"versions":["35.4.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"ac7169be0e69fe6e5fe9567a8c738baf7c152ac4a4d4f357f9ba25900c6e15ed","tlsh":"52b1a896126a70184b70e7e4c7178825f55af6a33781c298fb5c65844f77124c3b2efc"}],"package_integrity":[{"filename":"bigops-operator-status-35.4.5.tgz","hashes":{"sha1":"93d4d4449aaee5e31e51894304368b406f6eafa3","sha512_sri":"sha512-I16kfWyXeOvAtIfaoIFz5umMsD+WfaCyiWPBhI6/wPjeF6aIzJXt4NpZeOI/mzmLDG1J043g6G9J8J1WCQEcyQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-operator-status/MAL-2026-13230.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-operator-status/v/35.4.5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015766","import_time":"2026-08-05T16:13:42.784056923Z","modified_time":"2026-08-05T15:36:48Z","sha256":"0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a","source":"amazon-inspector","versions":["35.4.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}