bigops-auth-cache @35.3.9
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12150
Ecosystem
npm
Summary
On require('bigops-auth-cache'), index.js loads _compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) and *.dl.wel1.ru domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to a temp file with a disguised name (dotnet_diag_*.exe /.cache_*), chmods 0755, and spawns it detached via cmd.exe or /bin/sh (_compat.js line 124-130). Hostnames are assembled at runtime from split-string arrays (['sdk.dl.w','el1','.ru'].join('')) to evade static detection. A DNS TXT-record covert channel serves as fallback payload delivery: a count record at c.<domain> and chunked base64 payload at N.<domain> are reassembled and executed. No hash or signature verification. Cover-story comments describe the code as 'analytics' / 'telemetry' / 'session management', contradicting the observed dropper behavior.
Source: amazon-inspector (f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.