bigops-communication-clientnpm
Advisory published Updated
bigops-communication-client is a confirmed malicious npm package (MAL-2026-12161) that typosquats a legitimate package to trick installs (malicious version 35.8.8). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in bigops-communication-client (npm)
What this malware does
On require() of the package, index.js loads platform.js which invokes init() at module top level. init() downloads an opaque binary from Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, cf100-416, cf103-070, cf99-9b3.workers.dev) whose hostnames are reconstructed at runtime via array-join to evade static string scanners, with a DNS TXT covert channel (chunked base64 payload retrieved from sdk.dl.wel1.ru) as fallback. The fetched bytes are written to /tmp or %TEMP% under names impersonating.NET diagnostic tools (dotnet_diag<tag>.exe,.cache_<tag>), chmod 0755 on Unix, then spawned detached via /bin/sh -c or cmd.exe start /b with stdio ignored. Anti-analysis logic aborts execution if DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are set and stamps /tmp/.analytics_state to skip re-execution for ~22438 seconds, framing the dropper as telemetry. There is no legitimate purpose for a require()-time fetch-and-execute of an unpinned, unverified binary from anonymous Workers hosts with runtime host reconstruction and a DNS-TXT payload channel.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Search your lockfiles and build artifacts for bigops-communication-client (version 35.8.8).
If you installed it — respond
bigops-communication-client is a typosquat — you almost certainly intended a legitimately-named package. Remove bigops-communication-client, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If bigops-communication-client was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks bigops-communication-client-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.