OpenSSF/OSV advisory MAL-2026-12038 confirms this npm version as malicious. The package's main entry requires `./_ext`, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf102-baf.workers.dev), assembled at runtime from split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bigops-customer (npm)
Details
The package's main entry requires `./_ext`, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf102-baf.workers.dev), assembled at runtime from split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmod 0755'd, and spawned detached via `/bin/sh` or `cmd.exe`. No hash or signature verification. A DNS TXT-record fallback channel (`c.<domain>` chunk count plus numbered subdomains, base64-decoded and joined) retrieves the payload when HTTPS fails. Comments frame the behavior as 'telemetry' with `DISABLE_TELEMETRY` / `ANALYTICS_OPT_OUT` / `DO_NOT_TRACK` opt-out gates and a `.analytics_state` re-run cooldown marker; the package description ('Bigops customer abstraction layer') is generic and unrelated to the actual code. Destinations are anonymous serverless hosts unrelated to any publisher identity; the fetched code is opaque and runs with the installer's privileges as a consequence of `require('bigops-customer')`.
Decision reason
OpenSSF Malicious Packages via OSV confirms bigops-customer@35.1.1 as malicious (MAL-2026-12038): Malicious code in bigops-customer (npm)