MalwarePublished 5 Aug 2026

bigops-logs-player (npm) · Malicious Code

Affects bigops-logs-playerSource GCVE Database

Malicious package : remove bigops-logs-player and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 22:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13223

What to do

Remove bigops-logs-player from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-logs-player	Affected =35.2.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bigops-logs-player npm package version 35.2.8 contains malicious code that downloads and executes an OS-specific native binary from attacker-controlled infrastructure. It uses obfuscation techniques to hide Cloudflare Workers hostnames and employs a DNS-TXT covert channel as a fallback. The native binary is saved to temporary directories with disguised filenames and executed detached from the main process. This behavior is unrelated to the package's advertised logging functionality.

Impact

The malicious code enables remote code execution by downloading and running attacker-controlled native binaries on the host system. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and covert channel techniques complicate detection and analysis. Since the package masquerades as a legitimate logging library, users may inadvertently install and execute this malware.

Defensive guidance

Users should immediately stop using bigops-logs-player version 35.2.8 and remove it from their environments. Avoid installing or running this package from untrusted sources. Monitor for any processes spawned from temporary directories with suspicious names. Consider using trusted package registries and scanning tools to detect malicious packages.

Summary

The bigops-logs-player package version 35.2.8 includes code in index.js that loads a polyfill script which reconstructs obfuscated Cloudflare Workers hostnames to evade static detection. It downloads a native binary specific to the operating system via HTTPS, writes it to a temporary directory under a disguised filename, sets executable permissions, and spawns it detached using system shells (/bin/sh or cmd.exe). If the primary hosts are unreachable, it uses a DNS-TXT covert channel to resolve alternate hosts under *.dl.wel1.ru, also obfuscated. Execution is gated by freshness markers and environment opt-outs to reduce detection noise. This malicious behavior is unrelated to the package's stated purpose as a log transport library.

References

npmjs.com/package/bigops-logs-player/v/35.2.8 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 22:47 UTC

Technical details

References

Community reviews