Malicious code in bigops-telephony-ui (npm)
The npm package bigops-telephony-ui version 35.7.3 contains malicious code that downloads and executes a platform-specific binary from suspicious external hosts. This binary is saved to temporary directories and executed with elevated permissions, enabling full system compromise. The package masquerades as a React UI component library, but its behavior is inconsistent with this purpose. Any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated from a clean system. Removal of the package alone does not guarantee elimination of the compromise.
AI Analysis
Technical Summary
The bigops-telephony-ui npm package version 35.7.3 includes a malicious _shim.js script that dynamically constructs hostnames to download a platform-specific executable over HTTPS from multiple suspicious domains, including Cloudflare Workers and fallback DNS TXT records pointing to *.dl.wel1.ru subdomains. The downloaded binary is saved to temporary locations on Unix or Windows systems, permissions are set to executable, and it is spawned detached via shell commands. The package uses runtime string assembly to evade static analysis. Its advertised purpose as a React UI component library does not align with the behavior of fetching and executing anonymous binaries, indicating malicious intent. This results in full system compromise.
Potential Impact
Systems with bigops-telephony-ui version 35.7.3 installed are fully compromised, allowing attackers to execute arbitrary code with system privileges. All stored secrets and keys on the affected system are at risk and must be rotated. The compromise may persist even after package removal due to potential additional malware installed by the malicious binary.
Mitigation Recommendations
Immediate removal of the bigops-telephony-ui package version 35.7.3 is required. However, because the system is considered fully compromised, all secrets and keys stored on the affected machine must be rotated from a separate, clean system. Comprehensive incident response should be conducted to identify and eradicate any persistent malicious components. No official patch or fix is available; remediation relies on removal and recovery procedures.
Malicious code in bigops-telephony-ui (npm)
Description
The npm package bigops-telephony-ui version 35.7.3 contains malicious code that downloads and executes a platform-specific binary from suspicious external hosts. This binary is saved to temporary directories and executed with elevated permissions, enabling full system compromise. The package masquerades as a React UI component library, but its behavior is inconsistent with this purpose. Any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated from a clean system. Removal of the package alone does not guarantee elimination of the compromise.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The bigops-telephony-ui npm package version 35.7.3 includes a malicious _shim.js script that dynamically constructs hostnames to download a platform-specific executable over HTTPS from multiple suspicious domains, including Cloudflare Workers and fallback DNS TXT records pointing to *.dl.wel1.ru subdomains. The downloaded binary is saved to temporary locations on Unix or Windows systems, permissions are set to executable, and it is spawned detached via shell commands. The package uses runtime string assembly to evade static analysis. Its advertised purpose as a React UI component library does not align with the behavior of fetching and executing anonymous binaries, indicating malicious intent. This results in full system compromise.
Potential Impact
Systems with bigops-telephony-ui version 35.7.3 installed are fully compromised, allowing attackers to execute arbitrary code with system privileges. All stored secrets and keys on the affected system are at risk and must be rotated. The compromise may persist even after package removal due to potential additional malware installed by the malicious binary.
Defensive Guidance
Immediate removal of the bigops-telephony-ui package version 35.7.3 is required. However, because the system is considered fully compromised, all secrets and keys stored on the affected machine must be rotated from a separate, clean system. Comprehensive incident response should be conducted to identify and eradicate any persistent malicious components. No official patch or fix is available; remediation relies on removal and recovery procedures.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12842
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-wvf3-gj85-q2m7"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a74cfaebf8831d5391b23d5
Added to database: 08/06/2026, 18:17:18 UTC
Last enriched: 08/06/2026, 19:35:21 UTC
Last updated: 08/06/2026, 19:35:21 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.