MalwarePublished 5 Aug 2026

bigops-tcrm-identity-auth (npm) · Malicious Code

Affects bigops-tcrm-identity-authSource GCVE Database

Malicious package : remove bigops-tcrm-identity-auth and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12838

What to do

Remove bigops-tcrm-identity-auth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-tcrm-identity-auth	Affected =35.9.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bigops-tcrm-identity-auth version 35.9.3 is a malicious dropper disguised as a session-management utility. Upon installation or requiring the package, it fetches a platform-specific binary payload from dynamically assembled Cloudflare Workers URLs and fallback DNS-TXT channels. This payload is saved to temporary directories under misleading filenames, made executable, and then executed detached from the main process. The package includes mechanisms to evade detection and re-execute conditionally. Installing or running this package results in arbitrary attacker-controlled native code execution on the host, effectively compromising the system.

Impact

Any system with bigops-tcrm-identity-auth@35.9.3 installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code on the host, which can lead to complete control over the system. All secrets and keys stored on the compromised machine should be considered exposed and must be rotated immediately from a secure, uncompromised environment. Removal of the package alone does not guarantee eradication of all malicious components or persistence mechanisms installed by the attacker.

Defensive guidance

Immediate removal of bigops-tcrm-identity-auth@35.9.3 from all affected systems is required. It is critical to assume full compromise of any host where this package was installed or executed. All credentials, secrets, and keys stored on the affected systems must be rotated from a different, secure environment. Conduct a thorough investigation and remediation of the affected hosts to identify and remove any additional malware or persistence mechanisms introduced by the attacker.

Summary

bigops-tcrm-identity-auth@35.9.3 is a malicious npm package that acts as a dropper. Its main script loads a bootstrap file that dynamically constructs URLs to fetch a platform-specific binary payload from Cloudflare Workers hosts, using runtime string assembly to evade static detection. It also uses DNS-TXT fallback domains to retrieve the payload. The downloaded binary is stored in temporary directories with misleading names, permissions are set to executable, and it is launched detached via shell commands. The package contains environment variable kill switches and a filesystem stamp file to control re-execution. The presence of this package on a system allows arbitrary native code execution controlled by an attacker, leading to full system compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:35 UTC

Technical details

References

Community reviews