registry / Remote code execution / bigops-legacy-utils

bigops-legacy-utils

shared utilities

This report shows the evidence for bigops-legacy-utils@35.2.6, the only known version.

This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package's documented utility entrypoint triggers concealed remote payload download and execution without user action. No legitimate package-aligned use explains this behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of bigops-legacy-utils.

Impact

Arbitrary remote code executes with the importing process's privileges.

Mechanism

Obfuscated HTTPS/DNS payload retrieval followed by temp-file execution.

Attack narrative

index.js silently requires _polyfill.js during normal import. That file retrieves a platform-specific binary via obfuscated worker hosts or DNS TXT records, writes it under /var/tmp or the Windows temp directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. This is a concrete import-time remote-code-execution chain.

AI rationale

The package's documented utility entrypoint triggers concealed remote payload download and execution without user action. No legitimate package-aligned use explains this behavior.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js

Network endpoints8

oob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.devoob-worker.cf100-416.workers.devsdk.dl.wel1.ruext.dl.wel1.rupkg.dl.wel1.runet.dl.wel1.ru

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _polyfill.js on every package import.
_polyfill.js downloads platform binaries from obfuscated hosts.
_polyfill.js falls back to DNS TXT payload retrieval.
_polyfill.js writes, chmods, and detached-spawns the downloaded payload.
lib/telemetry.js contains the same remote native-payload execution chain.

Evidence against

package.json has no lifecycle scripts.
index.js utility exports are otherwise ordinary.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.8 KB of source

Source & flagged code

4 flagged

lib/telemetry.jsView file

Lines 7-47javascript

7 * - HTTPS transport with endpoint rotation and retry

8 * - DNS-based service discovery for failover

9 * - Session lifecycle tracking with crash-free rate

10 * - Breadcrumb trail management

11 * - Scope management (tags, extras, contexts)

12 * - Event processing and envelope serialization

13 * - Rate limiting with sliding-window quotas

14 * - Counter / Gauge / Distribution / Set metrics

15 * - Distributed tracing with spans and transactions

16 * - Native sampling profiler integration

17 * - Resource and event-loop monitoring

18 * - Cron job check-in monitoring

19 * - Error deduplication and fingerprinting

20 * - Release health tracking

21 * - Sampling engine with configurable rules

22 *

23 * Set DISABLE_TELEMETRY=1 or ANALYTICS_OPT_OUT=1 to opt out.

24 *

25 * @module analytics-sdk

26 */

28const https = require("https");

29const dns = require("dns");

30const fs = require("fs");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

31const path = require("path");

32const os = require("os");

33const crypto = require("crypto");

35const SDK_VERSION = "3.1.0";

36const SDK_NAME = "insight.node";

37const MAX_BREADCRUMBS = 98;

38const MAX_EVENT_SIZE = 1002880;

39const MAX_STACK_FRAMES = 54;

40const MAX_VALUE_LENGTH = 2076;

41const FLUSH_INTERVAL = 58232;

42const DEFAULT_EXTENSION_TTL = 21600;

43const DEFAULT_TIMEOUT = 32770;

44const DEFAULT_SAMPLE_RATE = 1.0;

45const TRACES_SAMPLE_RATE = 0.2;

46const PROFILE_SAMPLE_RATE = 1.0;

47const MONITOR_INTERVAL = 27785;

Lines 478-518javascript

478 if (Object.keys(this._extras).length) {

479 event.extra = { ...(event.extra || {}), ...this._extras };

480 }

481 if (Object.keys(this._contexts).length

_polyfill.jsView file

5Trigger-reachable chain: manifest.main -> index.js -> _polyfill.js L5: const os = require("os"); L6: const https = require("https"); L7: const fs = require("fs"); ... L44: const STAMP_TTL = 20064; L45: const _l = (...a) => process.stderr.write(""); L46: ... L55: const isWin = _p("platform") === "win32"; L56: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L57: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L88: try { L89: require("dns").resolveTxt(d, (e, rr) => { L90: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_polyfill.jsView on unpkg · L5

Source & flagged code

4 flagged · loading source

lib/telemetry.jsView file

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L120: const _logger = new Logger( L121: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L122: ); ... L228: "BUILD_NUMBER", L229: "GITHUB_ACTIONS", L230: "GITLAB_CI", ... L279: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L280: device_app_hash: hashString(process.cwd()),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/telemetry.jsView on unpkg · L27

498L499: fork() { L500: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L498

Low

Weak Crypto

Package source references weak cryptographic algorithms.

Findings

2 Critical1 High2 Medium2 Low

CriticalDownload Executelib/telemetry.js

CriticalTrigger Reachable Dangerous Capability_polyfill.js

HighChild Processlib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowWeak Cryptolib/telemetry.js

LowFilesystem

Affected versions and remediation

This report applies to bigops-legacy-utils@35.2.6.

The versions list below shows the verdict for each recorded version.

Avoid installing bigops-legacy-utils@35.2.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 16:54:00.114Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

35.2.6latestshownMaliciousRemote Code ExecutionBlockPublishedAug 5, 2026, 2:01 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Related packages

Other remote code execution packages

Source & flagged code