bigops-products-timeline

Details

**Severity:** Critical

**Affected versions:** `= 35.8.9`

## Source: amazon-inspector (f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8)
On require(), index.js loads _vendor.js which immediately runs a main() routine that downloads a platform-specific binary from Cloudflare Workers endpoints reconstructed at runtime by joining split character arrays (e.g. ['oob-worke','r.cf100-416.workers.d','ev'].join('')), with a DNS TXT fallback resolving *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). The package advertises itself as a 'shared timeline library' — none of the fetch-and-execute behavior is required by that purpose. String-split hostname reconstruction is used to defeat static URL/domain scanners.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7a679fd5edc3e2ed705b5a123e342a2da922e3ba/osv/malicious/npm/bigops-products-timeline/MAL-2026-13245.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7a679fd5edc3e2ed705b5a123e342a2da922e3ba/osv/malicious/npm/bigops-products-timeline/MAL-2026-13245.json
- https://www.npmjs.com/package/bigops-products-timeline/v/35.8.9
- https://github.com/advisories/GHSA-32v2-4x76-h3j5

Compromised versions (1)

• = 35.8.9

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.