Malicious code in bigops-telephony-mock (npm)
The npm package bigops-telephony-mock contained malicious code that downloads and executes platform-specific binaries from attacker-controlled servers upon package import. The malicious behavior was triggered automatically on require() with minimal gatekeeping, affecting any developer who installed and used the package.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed and required the bigops-telephony-mock package
- Ecosystems
- Attack vectors
- Affected entities
- bigops-telephony-mocknpm package containing malicious code
The npm package bigops-telephony-mock was found to contain malicious code embedded in its setup.js and lib/telemetry.js files. Upon requiring the package, the code reconstructs attacker-controlled hostnames from fragmented strings and uses DNS-TXT record fallbacks to retrieve download locations from domains including sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru.\n\nThe malicious payload downloads platform-specific binaries via HTTPS without any hash or signature verification, writes them to disguised temporary paths (such as analytics_state, dotnet_diag_.exe, or .cache_), sets executable permissions via fs.chmodSync(0755), and spawns them detached using shell commands (/bin/sh -c or cmd.exe /c start /b). The child_process module is obfuscated as "child_" + "process" to evade static analysis.\n\nThe attack is triggered automatically on any require() or import of the package, with only an opt-out environment variable and a TTL marker file as gatekeeping. This means a standard npm install followed by loading the module would cause attacker-controlled code to execute on the installer's machine. A second copy of the same loader is bundled in lib/telemetry.js, approximately 81KB in size.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- bigops-telephony-mock
- Domains
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall bigops-telephony-mock from all systems and projects
- Audit npm install logs and package-lock.json files to identify all systems where the package was installed
- Assume any system that installed and required the package may be compromised; perform forensic analysis for evidence of binary execution
- Review process execution logs and network connections from affected systems for suspicious activity to attacker-controlled domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm dependencies to remove any references to bigops-telephony-mock
- Monitor for similar malicious packages with obfuscated child_process usage or DNS-based payload delivery
Sources
- GitHub Advisory GHSA-g88g-2v35-hwhj · GitHub Advisory Database
Cite this entry
"Malicious code in bigops-telephony-mock (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-bigops-telephony-mock-npm-1v7i8h
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in eslint-generate-prerelease
Malware was discovered in the npm package eslint-generate-prerelease. Systems with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in resolve-audit
The npm package resolve-audit was compromised and distributed with malware. Any system with the package installed or running should be considered fully compromised and all secrets/keys rotated immediately from a different machine.
npmCompromised package - resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package