bigops-api@35.8.8: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Requiring the package immediately triggers a hidden remote payload loader. It downloads an OS-specific binary or DNS-delivered payload, drops it in a temp directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of bigops-api.

Impact

Unconsented arbitrary native code execution under the consuming process user.

Mechanism

Remote binary download, temp-file drop, chmod, and detached shell execution.

Attack narrative

The declared entrypoint silently requires _compat.js. Its immediately invoked main function retrieves a payload from obfuscated remote hosts or DNS TXT records, writes it to /var/tmp or a Windows temp directory, marks non-Windows payloads executable, and starts them detached via /bin/sh or cmd.exe. The payload is neither authenticated nor package-aligned.

Rationale

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: fetched executable bytes are launched without validation. Lack of an install hook does not mitigate the reachable runtime execution.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js

Network endpoints8

oob-worker.cf102-baf.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.devsdk.dl.wel1.ruext.dl.wel1.rupkg.dl.wel1.runet.dl.wel1.ru

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _compat.js at package import time.
_compat.js downloads platform binaries from obfuscated Workers hosts.
_compat.js falls back to DNS TXT payload retrieval.
Downloaded bytes are written to temp, made executable, and detached-spawned.
No integrity/signature validation precedes execution.

Evidence against

package.json has no lifecycle scripts.
lib/telemetry.js is not imported by the entrypoint.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.7 KB of source

Source & flagged code

4 flagged

_compat.jsView file

2L3: const https = require("https"); L4: const fs = require("fs"); ... L44: const MAX_AGE = 21858; L45: const _l = (...a) => process.stderr.write(""); L46: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_compat.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js -> _compat.js L2: L3: const https = require("https"); L4: const fs = require("fs"); ... L44: const MAX_AGE = 21858; L45: const _l = (...a) => process.stderr.write(""); L46: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_compat.jsView on unpkg · L2

121try { L122: const cp = require("child_process"); L123: if (isWin) {

High

Child Process

Package source references child process execution.

_compat.jsView on unpkg · L121

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = devplatform-spa-plugin-dom-render@35.5.5 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:35.5.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged · loading source

_compat.jsView file

2L3: const https = require("https"); L4: const fs = require("fs"); ... L44: const MAX_AGE = 21858; L45: const _l = (...a) => process.stderr.write(""); L46: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_compat.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js -> _compat.js L2: L3: const https = require("https"); L4: const fs = require("fs"); ... L44: const MAX_AGE = 21858; L45: const _l = (...a) => process.stderr.write(""); L46: ... L57: const isWin = _p("platform") === "win32"; L58: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L59: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_compat.jsView on unpkg · L2

121try { L122: const cp = require("child_process"); L123: if (isWin) {

Findings

2 Critical2 High2 Medium1 Low

CriticalDownload Execute_compat.js

CriticalTrigger Reachable Dangerous Capability_compat.js

HighChild Process_compat.js

HighKnown Malware Source Similaritylib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem