Malicious code in bigops-eslint (npm)
The npm package bigops-eslint contained malicious code that acted as an import-time dropper, fetching and executing attacker-controlled binaries on installation. The package disguised itself as an eslint helper but unconditionally loaded malicious code that downloaded OS-specific executables from hardcoded remote hosts via HTTPS or DNS-TXT covert channels.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed bigops-eslint via npm during the malicious distribution period.
- Ecosystems
- Attack vectors
- Affected entities
- bigops-eslintnpm package containing malicious code
The npm package bigops-eslint was distributed with malicious code that executed upon require() of index.js. The package advertised itself as an eslint helper but contained a hidden _helpers.js module that performed reconnaissance and payload delivery.
The malicious code fetched OS-specific executables over HTTPS from multiple hardcoded command-and-control domains (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, and sdk/ext/pkg/net.dl.wel1.ru). It implemented a DNS-TXT chunked base64 fallback channel for covert communication, demonstrating anti-analysis capabilities.
Downloaded payloads were written to temporary directories (/tmp or %TEMP%) under disguised filenames (.cache_, dotnet_diag_.exe), made executable (chmod 0755), and spawned as detached processes via shell commands (/bin/sh -c or cmd.exe /c start /b) with .unref() to ensure survival independent of the parent process.
This represents a classic supply chain attack vector: a trojanized package that executes malicious code at import time, compromising any developer machine or CI/CD system that installed it.
Indicators of compromise
- Packages
- bigops-eslint
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf101-adf.workers.dev
- sdk/ext/pkg/net.dl.wel1.ru
Remediation
- Immediately uninstall bigops-eslint from all systems and development environments
- Audit npm package.json and lock files for any dependency on bigops-eslint
- Review system logs and process execution history on machines that installed this package for signs of unauthorized executable downloads or process spawning
- Regenerate any credentials or signing keys that may have been exposed on compromised systems
- Update npm to the latest version and run 'npm audit' to identify other potentially compromised dependencies
- Consider using npm package integrity verification tools and private package registries to prevent similar attacks
Sources
- GitHub Advisory GHSA-8vwm-3x9f-mccp · GitHub Advisory Database
Cite this entry
"Malicious code in bigops-eslint (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-eslint-npm-15fx8p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package