Malicious code in bigops-telephony (npm)
The bigops-telephony npm package version 35.8.4 contains malicious code that downloads and executes opaque binaries from remote hosts, disguising them as telemetry components. This behavior results in full system compromise, allowing attackers to gain control over the affected computer. The package uses environment variables and marker files to evade detection and mimic legitimate telemetry. Removal of the package alone does not guarantee eradication of the malicious payloads. Immediate secret and key rotation is advised for compromised systems.
AI Analysis
Technical Summary
The bigops-telephony npm package (version 35.8.4) includes malicious code that, upon requiring the package, loads a script which dynamically fetches a binary payload from multiple runtime-assembled remote hosts. This binary is saved to temporary directories under disguised filenames, given executable permissions, and executed detached via shell commands. The execution is gated by environment variables and a marker file to simulate legitimate telemetry activity. An additional dropper module shipped with the package performs similar actions under the guise of an analytics SDK. This results in full compromise of any system running the package, with attackers potentially gaining persistent control.
Potential Impact
Systems with the bigops-telephony package version 35.8.4 installed or running are fully compromised. Attackers may have complete control over the host, risking exposure of all stored secrets and keys. Simply removing the package does not guarantee removal of all malicious components or backdoors introduced by the payloads.
Mitigation Recommendations
Remove the bigops-telephony package version 35.8.4 immediately. Rotate all secrets and keys from a separate, uncompromised system. Due to the nature of the full system compromise, further forensic analysis and remediation may be necessary to ensure complete eradication of malicious software. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in bigops-telephony (npm)
Description
The bigops-telephony npm package version 35.8.4 contains malicious code that downloads and executes opaque binaries from remote hosts, disguising them as telemetry components. This behavior results in full system compromise, allowing attackers to gain control over the affected computer. The package uses environment variables and marker files to evade detection and mimic legitimate telemetry. Removal of the package alone does not guarantee eradication of the malicious payloads. Immediate secret and key rotation is advised for compromised systems.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bigops-telephony npm package (version 35.8.4) includes malicious code that, upon requiring the package, loads a script which dynamically fetches a binary payload from multiple runtime-assembled remote hosts. This binary is saved to temporary directories under disguised filenames, given executable permissions, and executed detached via shell commands. The execution is gated by environment variables and a marker file to simulate legitimate telemetry activity. An additional dropper module shipped with the package performs similar actions under the guise of an analytics SDK. This results in full compromise of any system running the package, with attackers potentially gaining persistent control.
Potential Impact
Systems with the bigops-telephony package version 35.8.4 installed or running are fully compromised. Attackers may have complete control over the host, risking exposure of all stored secrets and keys. Simply removing the package does not guarantee removal of all malicious components or backdoors introduced by the payloads.
Defensive Guidance
Remove the bigops-telephony package version 35.8.4 immediately. Rotate all secrets and keys from a separate, uncompromised system. Due to the nature of the full system compromise, further forensic analysis and remediation may be necessary to ensure complete eradication of malicious software. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12840
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-j5w7-ccfc-4mrf"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a74cfafbf8831d5391b23e7
Added to database: 08/06/2026, 18:17:19 UTC
Last enriched: 08/06/2026, 19:35:42 UTC
Last updated: 08/06/2026, 19:35:42 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.