Malicious code in bigops-auth-utils (npm)

Overview

bigops-auth-utils version 35.4.5 published to npm contained malicious code designed to drop and execute arbitrary binaries on any system that required or imported the package.

Attack Mechanism

The malicious payload was triggered at the top level of index.js via require('./setup'), which selected an OS/arch-specific binary path and downloaded executable code over HTTPS from three obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev). A DNS-TXT covert-channel fallback reassembled base64-encoded chunks from four additional domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).

The downloaded binary was written to temporary directories (/var/tmp on POSIX, %TEMP% on Windows) under disguised names (.cache_ on POSIX, dotnet_diag_.exe on Windows), made executable (chmod 0755), and spawned detached via shell commands (/bin/sh -c... & on Unix, cmd.exe /c start /b on Windows). A TTL marker prevented re-execution, and environment variable opt-out flags mimicked legitimate telemetry toggles.

Evasion Techniques

A duplicate copy of the drop-and-spawn logic was embedded in lib/telemetry.js, framed as an 'Analytics SDK'. The code used string concatenation (e.g., require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. Host construction via array-join splitting, DNS covert-channel fallback, and multiple execution paths are characteristic of a supply-chain dropper.