Malicious code in bigops-chat-tmsg (npm)
bigops-chat-tmsg, an npm package masquerading as a chat/messaging library, contained malicious code that silently downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package was identified and reported by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any project that installed bigops-chat-tmsg; systems running affected applications
- Ecosystems
- Attack vectors
- Affected entities
- bigops-chat-tmsgnpm package containing malicious dropper code
bigops-chat-tmsg is an npm package that advertised itself as a chat/messaging library but contained a sophisticated dropper payload. Upon require(), the package's index.js silently loads _runtime.js via a swallowed try/require statement appended after an empty stub class that exposes init/version/configure methods as cover.
The runtime.js module selects a platform-specific asset and downloads a binary from one of three obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev). The downloaded binary is written to /var/tmp or %TEMP% under a disguised name (.cache on Unix, dotnet_diag_.exe on Windows to impersonate a Microsoft diagnostic tool), given execute permissions (chmod 0755), and spawned detached via /bin/sh -c or cmd.
If HTTPS fetches fail, the code falls back to a covert DNS-TXT exfiltration channel using split-string-reconstructed domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). It resolves TXT records to determine chunk count and reassembles a base64-encoded executable from numbered subdomain TXT responses.
The entire real behavior is the dropper mechanism; the exported API is a non-functional stub used as cover. The package was identified and credited to OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- bigops-chat-tmsg
- Domains
- oob-worker.cf101-adf.workers.dev
- cf102-baf.workers.dev
- cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove bigops-chat-tmsg from all projects and dependencies
- Audit package-lock.json and yarn.lock files for any installation of bigops-chat-tmsg
- Assume any system that installed and required this package may be compromised; conduct forensic analysis for downloaded binaries in /var/tmp, %TEMP%, and related directories
- Check for suspicious processes spawned via /bin/sh -c or cmd.exe with unusual timing around package installation
- Review DNS query logs for requests to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru
- Implement npm package scanning and verification in CI/CD pipelines to detect similar malicious packages
- Monitor for outbound connections to the identified Cloudflare Workers hosts
Sources
- GitHub Advisory GHSA-rjrw-rx8c-5fp2 · GitHub Advisory Database
Cite this entry
"Malicious code in bigops-chat-tmsg (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-chat-tmsg-npm-zp3ht2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in cerebrum-core
Malware discovered in the npm package cerebrum-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package