MalwarePublished 5 Aug 2026

bigops-web-analytics (npm) · Malicious Code

Affects bigops-web-analyticsSource GCVE Database

Malicious package : remove bigops-web-analytics and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12858

What to do

Remove bigops-web-analytics from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbigops-web-analytics	Affected =35.9.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The bigops-web-analytics npm package version 35.9.4 contains malicious code that downloads and executes an opaque binary payload from obfuscated external hosts. This payload is saved to temporary locations on the infected system and executed without verification, allowing potential full system compromise. The package masquerades as a benign web analytics tool but performs unauthorized remote code execution.

Impact

Systems with this package installed or running are considered fully compromised. Attackers may have full control over the system, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious components or backdoors. Immediate secret/key rotation from a separate, uncompromised system is advised.

Defensive guidance

Remove the bigops-web-analytics package version 35.9.4 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a different, trusted environment. Due to the nature of the compromise, assume full system compromise and consider rebuilding affected systems.

Summary

The bigops-web-analytics package (npm ecosystem) version 35.9.4 includes malicious functionality triggered on require(). It loads a helper script that selects platform-specific endpoints and fetches a binary payload from obfuscated, string-split hosts. The payload is saved to temporary files on Linux or Windows systems with disguised filenames and executed detached via shell commands. No integrity checks are performed on the downloaded payload. The package suppresses error output and uses a cover story unrelated to its actual behavior. This results in full compromise of any system running this package, with attackers gaining remote code execution and persistence.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:33 UTC

Technical details

References

Community reviews