Threats Tagged 'mal-2026-13237'

The npm package 'bigops-products-accounts-and-cards' version 35.7.5 contains malicious code that executes arbitrary attacker-controlled payloads on any system importing it. The package loads a platform-specific binary from obfuscated Cloudflare Workers hosts, writes it to a temporary location with disguised filenames, sets executable permissions, and spawns it detached from the main process. It also uses a DNS TXT-record base64 channel as a fallback delivery mechanism. Additionally, a secondary dropper disguised as an analytics SDK performs similar malicious actions. The code uses runtime string assembly to evade static detection. This results in arbitrary code execution on the consumer's machine.