MalwarePublished 5 Aug 2026

bigops-stylelint (npm) · Malicious Code

Affects bigops-stylelintSource GCVE Database

Malicious package : remove bigops-stylelint and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:36 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12834

What to do

Remove bigops-stylelint from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-stylelint	Affected =35.4.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bigops-stylelint npm package is a malicious typosquatting package that, upon being required, downloads and executes an unsigned platform-specific binary from attacker-controlled infrastructure. This binary is fetched via obfuscated hostnames and a DNS TXT-record covert channel, then executed on the victim system, potentially leading to full system compromise. The package masquerades as a stylelint quality gate tool but performs unauthorized remote code execution unrelated to its advertised purpose. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.

Impact

Installation or execution of this package results in the download and execution of unsigned remote binaries under attacker control, leading to full system compromise. Attackers may gain complete control over the affected system, potentially accessing all stored secrets and keys. Because the malicious code executes at import time, the compromise can occur immediately upon usage. Removal of the package alone may not eliminate all malicious artifacts or backdoors, necessitating secret rotation and comprehensive incident response.

Defensive guidance

Immediate removal of the bigops-stylelint package (version 35.4.3) is required. All secrets and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a thorough investigation and remediation of the host is recommended.

Summary

The bigops-stylelint npm package (version 35.4.3) is a malicious package impersonating legitimate stylelint tooling. When required, it loads a bootstrap script that downloads an unsigned binary from obfuscated Cloudflare Workers hosts, using a DNS TXT-record fallback to reconstruct the payload. The binary is saved to temporary directories and executed detached via shell commands. The package attempts to disguise this behavior as telemetry with opt-out environment variables and filenames mimicking dotnet diagnostics. This results in import-time execution of attacker-controlled unsigned code, effectively compromising the host system. The package is identified as a typosquat and should be removed immediately.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:36 UTC

Technical details

References

Community reviews