bigops-customer-processing-client @35.1.8
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12162
Ecosystem
npm
Summary
On require() of this package, index.js loads _support.js which unconditionally invokes setup(). setup() assembles C2 hostnames via.join('') from fragmented substrings, resolving to *.workers.dev endpoints (oob-worker.cf100-416.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev) with a DNS-TXT fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. A platform-specific binary is fetched over HTTPS, written to /tmp or %TEMP% under disguised filenames (dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755, and detach-spawned via cmd /c start /b or /bin/sh -c. No hash or signature verification is performed despite a comment claiming a SHA-256 check. Hostname fragmentation, cover-story comments, and disguised drop paths indicate deliberate evasion.
Source: amazon-inspector (f9d2fe146d4919092aae053b82b0caacff3789c10e63358f880fa5ab4590b3d2)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.