Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in bigops-auth-utils (npm)

bigops-auth-utils@35.4.5 on npm contained malicious code that executed a binary dropper at install/require time, downloading and spawning obfuscated executables from Cloudflare Workers and DNS covert channels. The package employed multiple evasion techniques including string obfuscation, duplicated execution paths, and telemetry-themed opt-out flags.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any npm project that installed bigops-auth-utils@35.4.5 and executed it (via require/import) would have downloaded and executed a binary dropper.
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • bigops-auth-utils · 35.4.5

Overview

bigops-auth-utils version 35.4.5 published to npm contained malicious code designed to drop and execute arbitrary binaries on any system that required or imported the package.

Attack Mechanism

The malicious payload was triggered at the top level of index.js via require('./setup'), which selected an OS/arch-specific binary path and downloaded executable code over HTTPS from three obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev). A DNS-TXT covert-channel fallback reassembled base64-encoded chunks from four additional domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).

The downloaded binary was written to temporary directories (/var/tmp on POSIX, %TEMP% on Windows) under disguised names (.cache_ on POSIX, dotnet_diag_.exe on Windows), made executable (chmod 0755), and spawned detached via shell commands (/bin/sh -c... & on Unix, cmd.exe /c start /b on Windows). A TTL marker prevented re-execution, and environment variable opt-out flags mimicked legitimate telemetry toggles.

Evasion Techniques

A duplicate copy of the drop-and-spawn logic was embedded in lib/telemetry.js, framed as an 'Analytics SDK'. The code used string concatenation (e.g., require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. Host construction via array-join splitting, DNS covert-channel fallback, and multiple execution paths are characteristic of a supply-chain dropper.

Indicators of compromise

Packages
  • bigops-auth-utils
Domains
  • oob-worker.cf100-416.workers.dev
  • oob-worker.cf103-070.workers.dev
  • oob-worker.cf101-adf.workers.dev
  • sdk.dl.wel1.ru
  • ext.dl.wel1.ru
  • pkg.dl.wel1.ru
  • net.dl.wel1.ru

Remediation

  • Immediately remove bigops-auth-utils@35.4.5 from all projects and dependencies.
  • Audit npm package-lock.json and yarn.lock files for any installation of bigops-auth-utils@35.4.5.
  • Review system logs and process execution history on any machine that installed or required this package for signs of unauthorized binary execution.
  • Block outbound HTTPS connections to the identified Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) and DNS queries to wel1.ru subdomains.
  • If the package was executed, assume system compromise and perform forensic analysis and remediation.
  • Monitor for any legitimate replacement or successor packages with similar names.

Sources

  1. GitHub Advisory GHSA-9m43-3q5c-855f · GitHub Advisory Database

Cite this entry

"Malicious code in bigops-auth-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-auth-utils-npm-19vk53

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in sme-rko-finance-front-operations-feed-models (npm)

    The npm package sme-rko-finance-front-operations-feed-models contained malicious code that downloads and executes attacker-controlled native binaries from remote servers upon package load. The malware uses obfuscation techniques including fragmented string arrays, platform-specific endpoints, and DNS TXT record fallbacks to evade detection.

    npmCompromised package
  2. resolvedcritical

    Malicious code in modern-localization (npm)

    The npm package modern-localization contained malicious code that fetches and executes arbitrary JavaScript from a remote jsonbin.io endpoint on server-side require, with no integrity verification. The payload is executed with full Node.js privileges via Function() or child_process.fork().

    npmCompromised package
  3. resolvedcritical

    Malicious code in sme-rko-finance-front-operations-tax (npm)

    The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.

    npmCompromised package
  4. resolvedcritical

    Malicious code in localization-fixer (npm)

    The npm package localization-fixer contained malicious code that fetches and executes arbitrary JavaScript from attacker-controlled jsonbin.io endpoints on package require, granting full Node.js capabilities to remote payloads.

    npmCompromised package