bigops-tcrm-permissionsnpm
Advisory published Updated
bigops-tcrm-permissions is a confirmed malicious npm package (MAL-2026-12839) that opens a backdoor for remote access (malicious versions 35.5.1, 35.6.1). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in bigops-tcrm-permissions (npm)
What this malware does
On require of bigops-tcrm-permissions, index.js loads runtime.js which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT base64 fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, writes the bytes to /var/tmp or %TEMP% under a hidden/decoy name, chmods the file 0755, and spawns it detached via /bin/sh -c or cmd. No hash or signature verification is performed, and the destinations are not associated with the package publisher. Destination hostnames and dangerous API names (require("child"+"process"), fs["chmod"+"Sync"]) are reassembled at runtime from string fragments to evade static matching. lib/telemetry.js contains a duplicate dropper flow (base64-assembled chunks, write, chmod 755, spawn /bin/sh detached) under an 'Analytics SDK' cover story, providing a second execution path against the same C2 infrastructure. The advertised purpose is a permissions SDK; dropping and executing native binaries from unrelated infrastructure is inconsistent with that purpose.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for bigops-tcrm-permissions (2 malicious versions).
If you installed it — respond
bigops-tcrm-permissions establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If bigops-tcrm-permissions was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks bigops-tcrm-permissions-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.