Malicious code in bigops-storio (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e) On require() of bigops-storio, _support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split *.workers.dev hosts (oob-worker.cf100-416.workers.dev, cf101-adf, cf99-9b3, cf103-070 under workers.dev), assembled at runtime via array.join("") to hide the destinations from static inspection. The fetched bytes are written to /tmp or %TEMP% under a hidden random filename (dot-prefixed / dotnet_diag-style cover names), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b with stdio ignored. A DNS-TXT fallback (txtFetch/dns.resolveTxt against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru — also assembled from string fragments) reassembles N base64-encoded TXT chunks into the same executable payload when HTTPS delivery fails. There is no version pinning, no hash or signature verification, and the fetched executable is unrelated to the package's stated storio abstraction purpose. The dropper runs automatically at library load time via index.js's try{require('./_support')}. ## Source: ghsa-malware (cd9ebb4bf8d8e6554d93f8343675d991c677dea6469481d1689813b405dca59c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The bigops-storio package (version 35.8.7) includes a malicious dropper in its _support.js module that dynamically selects one of several obfuscated workers.dev endpoints to fetch an opaque binary payload over HTTPS. If HTTPS delivery fails, it falls back to reconstructing the payload from base64-encoded DNS TXT records from multiple dl.wel1.ru subdomains. The payload is saved under a hidden random filename in the system's temporary directory, permissions are set to executable, and it is spawned detached using shell commands without standard input/output. This execution occurs automatically during the package load via index.js requiring _support.js. There is no integrity verification of the fetched payload, and the behavior is unrelated to the package's intended storio abstraction functionality.
Potential Impact
This malicious behavior allows arbitrary code execution on any system that installs and requires bigops-storio version 35.8.7. The attacker can run any binary payload fetched from external servers, potentially leading to full system compromise, data theft, or further malware deployment. The lack of integrity checks and obfuscation techniques complicate detection and prevention.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid using bigops-storio version 35.8.7 and remove it from their environments. Since the package fetches and executes remote code without verification, it is unsafe to use. Monitor for any unexpected processes spawned from temporary directories and consider scanning affected systems for the malicious payload. Check for vendor advisories or updates for official fixes.
Malicious code in bigops-storio (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e) On require() of bigops-storio, _support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split *.workers.dev hosts (oob-worker.cf100-416.workers.dev, cf101-adf, cf99-9b3, cf103-070 under workers.dev), assembled at runtime via array.join("") to hide the destinations from static inspection. The fetched bytes are written to /tmp or %TEMP% under a hidden random filename (dot-prefixed / dotnet_diag-style cover names), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b with stdio ignored. A DNS-TXT fallback (txtFetch/dns.resolveTxt against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru — also assembled from string fragments) reassembles N base64-encoded TXT chunks into the same executable payload when HTTPS delivery fails. There is no version pinning, no hash or signature verification, and the fetched executable is unrelated to the package's stated storio abstraction purpose. The dropper runs automatically at library load time via index.js's try{require('./_support')}. ## Source: ghsa-malware (cd9ebb4bf8d8e6554d93f8343675d991c677dea6469481d1689813b405dca59c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bigops-storio package (version 35.8.7) includes a malicious dropper in its _support.js module that dynamically selects one of several obfuscated workers.dev endpoints to fetch an opaque binary payload over HTTPS. If HTTPS delivery fails, it falls back to reconstructing the payload from base64-encoded DNS TXT records from multiple dl.wel1.ru subdomains. The payload is saved under a hidden random filename in the system's temporary directory, permissions are set to executable, and it is spawned detached using shell commands without standard input/output. This execution occurs automatically during the package load via index.js requiring _support.js. There is no integrity verification of the fetched payload, and the behavior is unrelated to the package's intended storio abstraction functionality.
Potential Impact
This malicious behavior allows arbitrary code execution on any system that installs and requires bigops-storio version 35.8.7. The attacker can run any binary payload fetched from external servers, potentially leading to full system compromise, data theft, or further malware deployment. The lack of integrity checks and obfuscation techniques complicate detection and prevention.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid using bigops-storio version 35.8.7 and remove it from their environments. Since the package fetches and executes remote code without verification, it is unsafe to use. Monitor for any unexpected processes spawned from temporary directories and consider scanning affected systems for the malicious payload. Check for vendor advisories or updates for official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13252
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a738521bf8831d5394ef9a7
Added to database: 08/05/2026, 18:46:57 UTC
Last enriched: 08/05/2026, 22:18:32 UTC
Last updated: 09/07/2026, 22:20:09 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.