Malicious code in bigops-security (npm)
The npm package bigops-security contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure when required. The package was disguised as a security module but performed fetch-and-execute of opaque binaries from obfuscated Cloudflare Workers hosts and DNS-TXT fallback domains.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious bigops-security package and executed it via require().
- Ecosystems
- Attack vectors
- Affected entities
- bigops-securitynpm package containing malicious code
The npm package bigops-security was found to contain malicious code that executes arbitrary binaries on systems where the package is imported. Upon require('bigops-security'), the index.js file loads _bridge.js, which fetches platform-specific executables from attacker-controlled infrastructure.
The malicious code uses obfuscation techniques to hide its true intent. Destination hostnames are reconstructed at runtime from split string arrays (e.g., ['sdk','.dl.','wel1.','ru'].join('')) rather than appearing as plain literals. The package attempts to fetch binaries from obfuscated Cloudflare Workers hosts (oob-worker.cf10{0..3}-*.workers.dev) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru subdomains.
The fetched executables are written to temporary directories (/tmp or %TEMP%) under disguised names such as dotnet_diag_.exe and .cache_, given execute permissions (chmod 755), and then spawned via shell commands. The package falsely advertises itself as a security module and uses misleading identifiers like "analytics," "telemetry," "CDN," and "Respect opt-out" to frame the malicious behavior as benign functionality.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- bigops-security
- Domains
- oob-worker.cf100-*.workers.dev
- oob-worker.cf101-*.workers.dev
- oob-worker.cf102-*.workers.dev
- oob-worker.cf103-*.workers.dev
- *.dl.wel1.ru
Remediation
- Immediately uninstall the bigops-security package from all systems and projects
- Audit npm package.json and lock files for any presence of bigops-security
- Review system logs and process execution history on any machines where bigops-security was installed for signs of unauthorized binary execution
- Check for suspicious files in /tmp and %TEMP% directories matching patterns like dotnet_diag_* and .cache_*
- Monitor network traffic for connections to oob-worker.cf10*.workers.dev and *.dl.wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use npm audit to check for other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-8hhq-8p53-392c · GitHub Advisory Database
Cite this entry
"Malicious code in bigops-security (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-security-npm-1rsp1b
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gunzip-js (npm)
The npm package gunzip-js version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.
npmCompromised package