bigops-shared-product-design (npm) · Malicious Code
Affects bigops-shared-product-designSource GCVE Database
Malicious package : remove bigops-shared-product-design and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 15:27 UTC
Malicious package
Published to npm · OSV MAL-2026-13526
What to do
Remove bigops-shared-product-design from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbigops-shared-product-design | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package bigops-shared-product-design version 35.9.3 contains malicious code that unconditionally loads a module which downloads and executes a platform-specific native binary from suspicious Cloudflare Workers hosts and fallback DNS-TXT resolver domains. The downloaded payload is saved to temporary directories with masqueraded filenames, given executable permissions, and executed detached from the parent process. This behavior is indicative of a dropper toolkit designed to evade static analysis and persist on the system.