Threats Tagged 'mal-2026-12149'

The bigops-auth npm package version 35.8.6 contains malicious code that executes at require() time. It reconstructs obfuscated Cloudflare Workers hostnames and DNS resolver domains to fetch a platform-specific executable from attacker-controlled infrastructure. This executable is saved with disguised names mimicking legitimate diagnostic files, given executable permissions, and launched detached on the host system. The package masquerades as an authentication token handler but performs unauthorized remote code execution without integrity checks. Any system with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated from a separate, clean device.