MalwarePublished 5 Aug 2026

bigops-alerts-widget (npm) · Malicious Code

Affects bigops-alerts-widgetSource GCVE Database

Malicious package : remove bigops-alerts-widget and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:37 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12831

What to do

Remove bigops-alerts-widget from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-alerts-widget	Affected =35.8.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bigops-alerts-widget npm package version 35.8.3 contains malicious code that executes attacker-controlled binaries during import. It downloads obfuscated payloads from anonymous Cloudflare Workers and uses DNS TXT record queries as a fallback to retrieve and execute binaries. This results in remote code execution on the host system. Any system with this package installed should be considered fully compromised, and all secrets should be rotated. Removal of the package does not guarantee complete remediation due to potential persistence of malicious software.

Impact

Systems with the affected package installed are fully compromised, allowing attackers to execute arbitrary code remotely. This compromises confidentiality, integrity, and availability of the host. All stored secrets and keys on the compromised system are at risk and should be rotated immediately from a secure environment. Removal of the package alone may not remove all malicious artifacts, indicating potential persistence mechanisms.

Defensive guidance

Immediate removal of the bigops-alerts-widget package version 35.8.3 is recommended. All secrets and keys stored on the compromised system should be rotated from a different, secure computer. Due to the high risk of full system compromise and potential persistence, a full incident response and system rebuild may be necessary. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.

Summary

The bigops-alerts-widget npm package (version 35.8.3) includes malicious code that triggers on require() calls. It dynamically selects a payload based on the host platform and architecture, then downloads an opaque binary from obfuscated Cloudflare Workers URLs. The binary is saved to temporary directories under disguised filenames, permissioned to execute, and spawned detached via shell commands. If the primary download fails, a fallback mechanism uses multiple DNS TXT queries to covertly retrieve a base64-encoded executable, which is then run similarly. This import-time execution of attacker-controlled binaries enables remote code execution on the host machine, effectively compromising the system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:37 UTC

Technical details

References

Community reviews