MalwarePublished 5 Aug 2026

bigops-products-bnpl (npm) · Malicious Code

Affects bigops-products-bnplSource GCVE Database

Malicious package : remove bigops-products-bnpl and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 22:32 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13238

What to do

Remove bigops-products-bnpl from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-products-bnpl	Affected =35.2.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'bigops-products-bnpl' version 35.2.9 contains malicious code that, when required, downloads and executes arbitrary binaries from attacker-controlled Cloudflare Workers endpoints. This behavior results in arbitrary code execution on the machine loading the package, bypassing any integrity checks and disguising the payload as telemetry or analytics. No official patch or remediation guidance is provided.

Impact

This vulnerability allows an attacker to execute arbitrary code on any system that installs and requires the affected package version, potentially leading to full system compromise. Because the malicious payload is downloaded and executed without verification, the attacker can change the payload at will, increasing the risk and impact. There are no known exploits in the wild reported at this time.

Defensive guidance

Users should avoid installing or requiring version 35.2.9 of the 'bigops-products-bnpl' package. Consider using alternative trusted packages or verifying package integrity before use. Monitor vendor advisories for any future updates or fixes.

Summary

The 'bigops-products-bnpl' npm package version 35.2.9 includes code in its index.js that loads a runtime script which selects a platform-specific endpoint from four hardcoded Cloudflare Workers domains to download an opaque binary. This binary is saved under disguised filenames in temporary directories, given executable permissions, and executed detached via shell commands. The destination hostnames are constructed dynamically to evade static detection, and no hash or signature verification is performed. The package masquerades this behavior as telemetry or analytics functionality, but it effectively enables arbitrary attacker-controlled code execution on the host system upon loading the package.

References

npmjs.com/package/bigops-products-bnpl/v/35.2.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 22:32 UTC

Technical details

References

Community reviews