MalwarePublished 5 Aug 2026

bigops-ui-kit-styles (npm) · Malicious Code

Affects bigops-ui-kit-stylesSource GCVE Database

Malicious package : remove bigops-ui-kit-styles and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:34 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12850

What to do

Remove bigops-ui-kit-styles from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-ui-kit-styles	Affected =35.5.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bigops-ui-kit-styles version 35.5.7 contains malicious code that, upon import, fetches and executes a platform-specific binary from obfuscated Cloudflare Workers subdomains. The package itself provides no legitimate UI functionality and acts solely as a remote code loader. The downloaded executable is saved with deceptive filenames in temporary directories and run detached from the main process. Installation or use of this package results in full system compromise, requiring immediate secret and key rotation and package removal, though full remediation cannot be guaranteed due to potential persistent backdoors.

Impact

Any system with this package installed or running is considered fully compromised. The attacker gains remote code execution capabilities, potentially allowing full control over the affected machine. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not fully remove the attacker’s presence or any additional malware installed as a result of this compromise.

Defensive guidance

Remove the bigops-ui-kit-styles package version 35.5.7 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machines from a secure, unaffected environment. Due to the high likelihood of persistent compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system to ensure complete remediation. Monitor for any signs of persistent backdoors or additional malicious activity.

Summary

The bigops-ui-kit-styles npm package (version 35.5.7) is a malicious package that, when required, loads a script (_compat.js) which dynamically constructs URLs to fetch a platform-specific executable from obfuscated Cloudflare Workers subdomains with a DNS TXT fallback mechanism. This executable is saved under misleading filenames in temporary system directories, given executable permissions, and launched detached from the main process. The package exports a no-op stub class and contains no actual UI components, indicating its sole purpose is to perform remote code execution on the host system. This behavior effectively compromises any system that installs or runs this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:34 UTC

Technical details

References

Community reviews