Malicious code in bigops-chat-tmsg (npm)

bigops-chat-tmsg is an npm package that advertised itself as a chat/messaging library but contained a sophisticated dropper payload. Upon require(), the package's index.js silently loads _runtime.js via a swallowed try/require statement appended after an empty stub class that exposes init/version/configure methods as cover.

The runtime.js module selects a platform-specific asset and downloads a binary from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev). The downloaded binary is written to /var/tmp or %TEMP% under a disguised name (.cache on Unix, dotnet_diag_.exe on Windows to impersonate a Microsoft diagnostic tool), given execute permissions (chmod 0755), and spawned detached via /bin/sh -c or cmd.

If HTTPS fetches fail, the code falls back to a covert DNS-TXT exfiltration channel using split-string-reconstructed domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). It resolves TXT records to determine chunk count and reassembles a base64-encoded executable from numbered subdomain TXT responses.

The entire real behavior is the dropper mechanism; the exported API is a non-functional stub used as cover. The package was identified and credited to OpenSSF's malicious-packages project.