Malicious code in bigint.fs (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cb3e0cb5c95475ce69c3672be6acfb9283bc6e29a1d7ba7452c922e7dc96a966) On require()/import, index.js runs an IIFE that POSTs a getAccountInfo RPC call to https://api.devnet.solana.com for Solana account 4WF8QCFEnVD7BLs3QAVe2SjxRZ4n3EboCsdhj363VAqZ, base64-decodes the returned account data, reads a length prefix at offset 32, extracts the payload bytes at offset 36, and passes the resulting UTF-8 source to `new Function('require','module','exports', src)` — executing arbitrary JavaScript with the full privileges of the importing Node.js process. The payload is mutable (the attacker can rewrite the on-chain account data at any time), unpinned, not hash- or signature-verified, and delivered from infrastructure the attacker controls. The use of a public blockchain RPC endpoint as a C2 channel is designed to evade simple domain/IP blocking while remaining fully attacker-rewritable. The package name masquerades as a BigInt/filesystem utility; there is no legitimate reason for such a library to fetch and eval remote code on load. ## Source: ghsa-malware (b67cb388cf855ef52b8e274269861017bb7ce33349b187cd41ba2ff553ecb320) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The bigint.fs npm package versions 5.0.5 and 5.0.6 include an immediately invoked function expression (IIFE) in index.js that, upon require/import, sends a POST request to a Solana blockchain RPC endpoint to fetch account data from a specific account controlled by the attacker. The returned data is base64-decoded, parsed to extract a JavaScript payload, and executed using the Function constructor with full Node.js process privileges. The payload is attacker-controlled and mutable, allowing dynamic remote code execution. This technique uses a public blockchain RPC as a command-and-control channel to bypass traditional domain or IP blocking. The package masquerades as a BigInt/filesystem utility but performs unauthorized remote code execution on load.
Potential Impact
Any system with bigint.fs versions 5.0.5 or 5.0.6 installed or running is fully compromised. The attacker gains the ability to execute arbitrary code with the full privileges of the Node.js process, potentially leading to complete system takeover. All secrets, credentials, and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removal of the package alone does not guarantee eradication of the attacker’s presence due to the full control potentially established.
Mitigation Recommendations
No official patch or fix is currently available. Immediate removal of the bigint.fs package versions 5.0.5 and 5.0.6 is strongly recommended. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the high likelihood of full system compromise, affected hosts should be considered untrusted and rebuilt if possible. Monitor for any signs of persistent malicious activity. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Malicious code in bigint.fs (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cb3e0cb5c95475ce69c3672be6acfb9283bc6e29a1d7ba7452c922e7dc96a966) On require()/import, index.js runs an IIFE that POSTs a getAccountInfo RPC call to https://api.devnet.solana.com for Solana account 4WF8QCFEnVD7BLs3QAVe2SjxRZ4n3EboCsdhj363VAqZ, base64-decodes the returned account data, reads a length prefix at offset 32, extracts the payload bytes at offset 36, and passes the resulting UTF-8 source to `new Function('require','module','exports', src)` — executing arbitrary JavaScript with the full privileges of the importing Node.js process. The payload is mutable (the attacker can rewrite the on-chain account data at any time), unpinned, not hash- or signature-verified, and delivered from infrastructure the attacker controls. The use of a public blockchain RPC endpoint as a C2 channel is designed to evade simple domain/IP blocking while remaining fully attacker-rewritable. The package name masquerades as a BigInt/filesystem utility; there is no legitimate reason for such a library to fetch and eval remote code on load. ## Source: ghsa-malware (b67cb388cf855ef52b8e274269861017bb7ce33349b187cd41ba2ff553ecb320) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bigint.fs npm package versions 5.0.5 and 5.0.6 include an immediately invoked function expression (IIFE) in index.js that, upon require/import, sends a POST request to a Solana blockchain RPC endpoint to fetch account data from a specific account controlled by the attacker. The returned data is base64-decoded, parsed to extract a JavaScript payload, and executed using the Function constructor with full Node.js process privileges. The payload is attacker-controlled and mutable, allowing dynamic remote code execution. This technique uses a public blockchain RPC as a command-and-control channel to bypass traditional domain or IP blocking. The package masquerades as a BigInt/filesystem utility but performs unauthorized remote code execution on load.
Potential Impact
Any system with bigint.fs versions 5.0.5 or 5.0.6 installed or running is fully compromised. The attacker gains the ability to execute arbitrary code with the full privileges of the Node.js process, potentially leading to complete system takeover. All secrets, credentials, and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removal of the package alone does not guarantee eradication of the attacker’s presence due to the full control potentially established.
Mitigation Recommendations
No official patch or fix is currently available. Immediate removal of the bigint.fs package versions 5.0.5 and 5.0.6 is strongly recommended. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the high likelihood of full system compromise, affected hosts should be considered untrusted and rebuilt if possible. Monitor for any signs of persistent malicious activity. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-3750
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-pcvf-7w5m-j39j"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c342c27e9c797195fa59e
Added to database: 07/06/2026, 23:03:08 UTC
Last enriched: 07/06/2026, 23:24:23 UTC
Last updated: 07/18/2026, 17:27:21 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.