Malicious code in bigops-create-manifest (npm)
The npm package bigops-create-manifest contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers and DNS infrastructure upon require. The package was identified by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed and required the malicious bigops-create-manifest package would execute arbitrary native binaries downloaded from attacker-controlled infrastructure.
- Ecosystems
- Attack vectors
- Affected entities
- bigops-create-manifestnpm package containing malicious code in index.js and _polyfill.js
The npm package bigops-create-manifest was found to contain malicious code designed to execute arbitrary native binaries. When the package is required, index.js loads polyfill.js, which selects a platform-specific endpoint and downloads an opaque native binary over HTTPS from one of several Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev).\n\nThe malware includes a DNS TXT covert-channel fallback mechanism that reads base64-encoded chunks from domains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched binary is written to a randomized filename disguised as dotnet_diag.exe on Windows or .cache_ under /var/tmp on Unix, given execute permissions (chmod 0755), and spawned detached via shell commands.\n\nThe package's advertised purpose as a manifest wrapper has no legitimate need for downloading and executing native binaries from third-party infrastructure. C2 hostnames and resolver domains are assembled at runtime via string manipulation, and the operation is framed as diagnostics through artifact naming and DISABLE_TELEMETRY environment variable checks.\n\nThe malicious package was identified and credited to the OpenSSF's malicious-packages project (MAL-2026-12037).
Indicators of compromise
- Packages
- bigops-create-manifest
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove bigops-create-manifest from all projects and dependencies
- Audit npm install logs and package-lock.json files to identify when the package was installed
- Scan systems that installed this package for unexpected processes, network connections, or suspicious binaries in /var/tmp or Windows temp directories
- Review environment variables and system logs for evidence of binary execution
- Update all dependencies and perform a full security audit of affected systems
- Consider the system compromised if the package was installed and required; perform forensic analysis and remediation
Sources
- GitHub Advisory GHSA-2p8g-p678-pf84 · GitHub Advisory Database
Cite this entry
"Malicious code in bigops-create-manifest (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-create-manifest-npm-a9d83j
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package