Malicious code in bigops-abstract-entity-data (npm)

The npm package bigops-abstract-entity-data was found to contain malicious code in its index.js file. Upon module load, the package unconditionally requires a hidden loader module that performs reconnaissance and payload delivery.\n\nThe loader.js module selects platform-specific asset paths and downloads executable bytes from a rotating list of anonymous Cloudflare Workers hosts (oob-worker.cf101-.workers.dev, oob-worker.cf102-.workers.dev, oob-worker.cf103-*.workers.dev, cf99-9b3.workers.dev). If primary hosts are unavailable, it falls back to DNS-TXT chunked resolution under *.dl.wel1.ru. Downloaded bytes are written to /tmp or %TEMP% under decoy filenames (.cache on Unix, dotnet_diag_.exe on Windows), given execute permissions (0755), and spawned detached via shell commands.\n\nNo hash or signature verification is performed on downloaded payloads. Simply requiring the package causes arbitrary attacker-controlled code to execute on the consumer's machine. The malware reconstructs destination hostnames and resolver domains at runtime from split string arrays to evade static analysis.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.