bigops-informer @35.4.8
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12171
Ecosystem
npm
Summary
On require(), index.js loads _bootstrap.js which reconstructs a set of destination hostnames from string-array joins (resolving to oob-worker.cf99-9b3.workers.dev, cf101-adf/cf102-baf/cf103-070.workers.dev, and sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), downloads a platform-specific executable via https.get, writes it to a temp path under disguised names (dotnet_diag_*.exe /.cache_*), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &']) or spawn('cmd',...) on Windows. If the HTTPS mirrors fail, _bootstrap.js falls back to a DNS TXT covert channel: it resolves c.<domain> to get a chunk count, then resolves N.<domain> for each chunk, concatenates the base64 chunks, decodes them to a binary buffer, and writes+executes the result. The module also includes a TTL stamp and env-based opt-out checks consistent with hostile staging.
Source: amazon-inspector (324bb851ecf14c623080e07471bd23a7ea505bc6db244c654895a1cce71bf7e8)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.