MalwarePublished 5 Aug 2026

bigops-shared-ui (npm) · Malicious Code

Affects bigops-shared-uiSource GCVE Database

Malicious package : remove bigops-shared-ui and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 22:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13249

What to do

Remove bigops-shared-ui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-shared-ui	Affected =35.1.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bigops-shared-ui npm package version 35.1.2 contains malicious code that, upon requiring the package, downloads and executes a native binary from obfuscated Cloudflare Workers endpoints. The binary is selected based on platform and architecture, saved to a temporary location with a deceptive name, given execute permissions, and launched in a detached and hidden manner. This behavior establishes persistent attacker-controlled code execution on the host system. The package uses sophisticated evasion techniques including DNS TXT record fallback for payload retrieval, runtime assembly of command and control hostnames, and suppression of output to avoid detection.

Impact

This malicious package enables attackers to execute arbitrary native code on the host system with persistence and stealth. The downloaded executable runs detached and hidden, allowing ongoing attacker control without user awareness. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and fallback mechanisms increase the difficulty of detection and removal.

Defensive guidance

Users should immediately remove version 35.1.2 of bigops-shared-ui from their environments and avoid using this version. Investigate any systems where this package was installed for signs of compromise. Monitor for suspicious processes matching the described behavior. Check vendor advisories or trusted security sources for updates or official fixes.

Summary

The bigops-shared-ui npm package version 35.1.2 includes a malicious payload that triggers on require. It loads a setup script that downloads a native executable from obfuscated Cloudflare Workers endpoints, with a fallback mechanism using DNS TXT records from multiple domains to reconstruct base64-encoded payload fragments. The executable is chosen based on platform and architecture, saved to /tmp or %TEMP% under deceptive filenames, permissioned to execute, and spawned detached and hidden using shell commands. The code dynamically assembles command strings and child process invocations to evade static detection. It uses environment variables and flag files to throttle repeated fetches, and includes telemetry code with similar evasion patterns. This results in persistent, attacker-controlled code execution on the compromised host.

References

npmjs.com/package/bigops-shared-ui/v/35.1.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 22:17 UTC

Technical details

References

Community reviews