Malicious code in bigops-create-manifest (npm)
The npm package bigops-create-manifest contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled Cloudflare Workers and DNS infrastructure upon require. The package was identified by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed and required the malicious bigops-create-manifest package would execute arbitrary native binaries downloaded from attacker-controlled infrastructure.
- Ecosystems
- Attack vectors
- Affected entities
- bigops-create-manifestnpm package containing malicious code in index.js and _polyfill.js
The npm package bigops-create-manifest was found to contain malicious code designed to execute arbitrary native binaries. When the package is required, index.js loads polyfill.js, which selects a platform-specific endpoint and downloads an opaque native binary over HTTPS from one of several Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev).\n\nThe malware includes a DNS TXT covert-channel fallback mechanism that reads base64-encoded chunks from domains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched binary is written to a randomized filename disguised as dotnet_diag.exe on Windows or .cache_ under /var/tmp on Unix, given execute permissions (chmod 0755), and spawned detached via shell commands.\n\nThe package's advertised purpose as a manifest wrapper has no legitimate need for downloading and executing native binaries from third-party infrastructure. C2 hostnames and resolver domains are assembled at runtime via string manipulation, and the operation is framed as diagnostics through artifact naming and DISABLE_TELEMETRY environment variable checks.\n\nThe malicious package was identified and credited to the OpenSSF's malicious-packages project (MAL-2026-12037).
Indicators of compromise
- Packages
- bigops-create-manifest
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf102-baf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately remove bigops-create-manifest from all projects and dependencies
- Audit npm install logs and package-lock.json files to identify when the package was installed
- Scan systems that installed this package for unexpected processes, network connections, or suspicious binaries in /var/tmp or Windows temp directories
- Review environment variables and system logs for evidence of binary execution
- Update all dependencies and perform a full security audit of affected systems
- Consider the system compromised if the package was installed and required; perform forensic analysis and remediation
Sources
- GitHub Advisory GHSA-2p8g-p678-pf84 · GitHub Advisory Database
Cite this entry
"Malicious code in bigops-create-manifest (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-create-manifest-npm-a9d83j
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in checkout-common-tokens
Malware was discovered in the npm package checkout-common-tokens. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - activecritical
Malware in checkout-mobile-pay-button
The npm package checkout-mobile-pay-button contains malware that provides full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package