Malicious code in bigops-eslint (npm)
The npm package bigops-eslint contained malicious code that acted as an import-time dropper, fetching and executing attacker-controlled binaries on installation. The package disguised itself as an eslint helper but unconditionally loaded malicious code that downloaded OS-specific executables from hardcoded remote hosts via HTTPS or DNS-TXT covert channels.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed bigops-eslint via npm during the malicious distribution period.
- Ecosystems
- Attack vectors
- Affected entities
- bigops-eslintnpm package containing malicious code
The npm package bigops-eslint was distributed with malicious code that executed upon require() of index.js. The package advertised itself as an eslint helper but contained a hidden _helpers.js module that performed reconnaissance and payload delivery.
The malicious code fetched OS-specific executables over HTTPS from multiple hardcoded command-and-control domains (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, and sdk/ext/pkg/net.dl.wel1.ru). It implemented a DNS-TXT chunked base64 fallback channel for covert communication, demonstrating anti-analysis capabilities.
Downloaded payloads were written to temporary directories (/tmp or %TEMP%) under disguised filenames (.cache_, dotnet_diag_.exe), made executable (chmod 0755), and spawned as detached processes via shell commands (/bin/sh -c or cmd.exe /c start /b) with .unref() to ensure survival independent of the parent process.
This represents a classic supply chain attack vector: a trojanized package that executes malicious code at import time, compromising any developer machine or CI/CD system that installed it.
Indicators of compromise
- Packages
- bigops-eslint
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf101-adf.workers.dev
- sdk/ext/pkg/net.dl.wel1.ru
Remediation
- Immediately uninstall bigops-eslint from all systems and development environments
- Audit npm package.json and lock files for any dependency on bigops-eslint
- Review system logs and process execution history on machines that installed this package for signs of unauthorized executable downloads or process spawning
- Regenerate any credentials or signing keys that may have been exposed on compromised systems
- Update npm to the latest version and run 'npm audit' to identify other potentially compromised dependencies
- Consider using npm package integrity verification tools and private package registries to prevent similar attacks
Sources
- GitHub Advisory GHSA-8vwm-3x9f-mccp · GitHub Advisory Database
Cite this entry
"Malicious code in bigops-eslint (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-eslint-npm-15fx8p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package