MalwarePublished 5 Aug 2026

bigops-ui-kit (npm) · Malicious Code

Affects bigops-ui-kitSource GCVE Database

Malicious package : remove bigops-ui-kit and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:34 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12849

What to do

Remove bigops-ui-kit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-ui-kit	Affected =35.9.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bigops-ui-kit npm package is a malicious package that does not provide any UI code as advertised. Instead, it downloads and executes OS/architecture-specific native binaries from obfuscated external hosts upon import, resulting in remote code execution on the developer's machine. The malicious code writes disguised executables to temporary directories, sets executable permissions, and runs them detached from the parent process. This behavior effectively compromises any system that installs and imports the package, potentially exposing all stored secrets and keys.

Impact

Any system that installs and imports the bigops-ui-kit package version 35.9.2 is fully compromised with remote code execution capabilities granted to an attacker. This includes potential unauthorized access to all secrets, keys, and sensitive data stored on the affected machine. The attacker can execute arbitrary native code with the privileges of the user running the package, leading to complete system takeover.

Defensive guidance

The package should be immediately removed from all systems. All secrets and keys stored on affected machines should be considered compromised and rotated from a separate, trusted environment. Due to the nature of the compromise, a full system reinstallation or forensic analysis is recommended to ensure removal of any persistent malicious artifacts. Avoid installing or importing this package in any development or production environment.

Summary

The bigops-ui-kit npm package (version 35.9.2) is a malicious package that acts as a remote code execution dropper. On requiring the package, it loads a compatibility script that dynamically constructs URLs to download native payloads from obfuscated, non-standard hosts. These payloads are saved to disguised file paths in temporary directories, made executable, and launched in a detached process. The package uses obfuscation techniques such as string concatenation and indirect imports to hide its malicious behavior. Execution is controlled by environment variables and a stamp file, but once triggered, it grants full host compromise to attackers. This package does not contain legitimate UI code despite its advertised purpose.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:34 UTC

Technical details

References

Community reviews