Malicious code in bigops-rx-post-message (npm)
The npm package bigops-rx-post-message version 35.1.5 contains malicious code that downloads and executes an attacker-controlled binary during installation or require(). This binary is fetched from non-publisher infrastructure using obfuscated runtime-generated URLs and is executed without any integrity verification. The malicious executable is saved with disguised filenames in temporary directories and launched detached from the main process, enabling remote code execution on the host system.
AI Analysis
Technical Summary
The bigops-rx-post-message npm package (version 35.1.5) includes malicious code that triggers at module load time. It executes an initialization script that downloads a platform-specific binary from Cloudflare Workers domains and fallback URLs under attacker control. The downloaded binary is saved to temporary directories with disguised names, permissions are set to executable, and it is launched detached via shell commands. The package uses string concatenation to evade static detection of child_process and chmod calls. No hash or signature verification is performed on the downloaded executable, allowing arbitrary code execution on the host system upon installation or require().
Potential Impact
Installing or requiring the affected package version results in execution of an untrusted, attacker-controlled binary on the host system. This leads to full remote code execution capabilities for the attacker, potentially compromising the entire system where the package is installed.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or requiring bigops-rx-post-message version 35.1.5. Verify package integrity and source before installation. Consider removing the package if already installed. Monitor vendor advisories for updates or fixes.
Malicious code in bigops-rx-post-message (npm)
Description
The npm package bigops-rx-post-message version 35.1.5 contains malicious code that downloads and executes an attacker-controlled binary during installation or require(). This binary is fetched from non-publisher infrastructure using obfuscated runtime-generated URLs and is executed without any integrity verification. The malicious executable is saved with disguised filenames in temporary directories and launched detached from the main process, enabling remote code execution on the host system.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bigops-rx-post-message npm package (version 35.1.5) includes malicious code that triggers at module load time. It executes an initialization script that downloads a platform-specific binary from Cloudflare Workers domains and fallback URLs under attacker control. The downloaded binary is saved to temporary directories with disguised names, permissions are set to executable, and it is launched detached via shell commands. The package uses string concatenation to evade static detection of child_process and chmod calls. No hash or signature verification is performed on the downloaded executable, allowing arbitrary code execution on the host system upon installation or require().
Potential Impact
Installing or requiring the affected package version results in execution of an untrusted, attacker-controlled binary on the host system. This leads to full remote code execution capabilities for the attacker, potentially compromising the entire system where the package is installed.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or requiring bigops-rx-post-message version 35.1.5. Verify package integrity and source before installation. Consider removing the package if already installed. Monitor vendor advisories for updates or fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13248
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738521bf8831d5394ef9a1
Added to database: 08/05/2026, 18:46:57 UTC
Last enriched: 08/05/2026, 22:18:38 UTC
Last updated: 08/05/2026, 22:18:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.