Malicious code in bigops-telephony-mock (npm)
The bigops-telephony-mock npm package version 35.7.2 contains malicious code that executes automatically when the package is required or imported. It reconstructs destination hostnames at runtime to download a platform-specific binary from attacker-controlled domains, saves it to temporary directories under disguised filenames, sets executable permissions, and runs it detached from the main process. This behavior occurs without version pinning, hash verification, or signature checks, making it a supply chain risk. The malicious payload is also embedded as a telemetry SDK loader within the package. Execution is only prevented by an opt-out environment variable and a TTL marker file, so normal usage leads to attacker-controlled code execution on the host machine.
AI Analysis
Technical Summary
The bigops-telephony-mock npm package (version 35.7.2) contains embedded malicious code that triggers upon requiring or importing the package. The code dynamically reconstructs destination hostnames from split string fragments to evade static detection and downloads a platform-specific binary from multiple attacker-controlled domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The binary is saved under disguised filenames in temporary directories (/tmp or %TEMP%), permissions are set to executable (0755), and the binary is executed detached via shell commands. A second copy of the malicious loader is embedded as a telemetry SDK within the package. No integrity checks such as hash or signature verification are performed. This behavior activates on any require()/import of the package unless explicitly opted out via an environment variable or a TTL marker file. This results in remote code execution on the host machine of anyone installing and loading this package version.
Potential Impact
This malicious package enables remote code execution on the host system of any user who installs and requires/imports version 35.7.2 of bigops-telephony-mock. The attacker-controlled binaries are downloaded and executed without user consent or verification, potentially leading to full system compromise. The lack of integrity verification and runtime assembly of download URLs complicate detection and prevention. This represents a severe supply chain compromise risk for projects depending on this npm package version.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package version. Users should immediately avoid installing or using bigops-telephony-mock version 35.7.2. If already installed, remove the package and any related files from temporary directories. Consider scanning systems for the presence of the described binaries and network connections to the attacker-controlled domains. Monitor for environment variables or TTL marker files that may disable the malicious behavior. Check vendor advisories or trusted security sources for updates or official remediation guidance.
Malicious code in bigops-telephony-mock (npm)
Description
The bigops-telephony-mock npm package version 35.7.2 contains malicious code that executes automatically when the package is required or imported. It reconstructs destination hostnames at runtime to download a platform-specific binary from attacker-controlled domains, saves it to temporary directories under disguised filenames, sets executable permissions, and runs it detached from the main process. This behavior occurs without version pinning, hash verification, or signature checks, making it a supply chain risk. The malicious payload is also embedded as a telemetry SDK loader within the package. Execution is only prevented by an opt-out environment variable and a TTL marker file, so normal usage leads to attacker-controlled code execution on the host machine.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bigops-telephony-mock npm package (version 35.7.2) contains embedded malicious code that triggers upon requiring or importing the package. The code dynamically reconstructs destination hostnames from split string fragments to evade static detection and downloads a platform-specific binary from multiple attacker-controlled domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The binary is saved under disguised filenames in temporary directories (/tmp or %TEMP%), permissions are set to executable (0755), and the binary is executed detached via shell commands. A second copy of the malicious loader is embedded as a telemetry SDK within the package. No integrity checks such as hash or signature verification are performed. This behavior activates on any require()/import of the package unless explicitly opted out via an environment variable or a TTL marker file. This results in remote code execution on the host machine of anyone installing and loading this package version.
Potential Impact
This malicious package enables remote code execution on the host system of any user who installs and requires/imports version 35.7.2 of bigops-telephony-mock. The attacker-controlled binaries are downloaded and executed without user consent or verification, potentially leading to full system compromise. The lack of integrity verification and runtime assembly of download URLs complicate detection and prevention. This represents a severe supply chain compromise risk for projects depending on this npm package version.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package version. Users should immediately avoid installing or using bigops-telephony-mock version 35.7.2. If already installed, remove the package and any related files from temporary directories. Consider scanning systems for the presence of the described binaries and network connections to the attacker-controlled domains. Monitor for environment variables or TTL marker files that may disable the malicious behavior. Check vendor advisories or trusted security sources for updates or official remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13494
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75f712bf8831d53984fc0c
Added to database: 08/07/2026, 15:17:38 UTC
Last enriched: 08/07/2026, 15:48:07 UTC
Last updated: 08/07/2026, 22:42:18 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.