{"answers":{"affected":"1 open source package ship an affected version, including bigops-backend.","exploited":"There is no known exploitation of MAL-2026-11535 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-11535 is a malicious package in bigops-backend, published on 4 Aug 2026."},"fix_prompt":"MAL-2026-11535 is a malicious package: bigops-backend (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-11535/ (Markdown: https://insights.sbomify.com/MAL-2026-11535/index.md)","id":"MAL-2026-11535","markdown":"https://insights.sbomify.com/MAL-2026-11535/index.md","name":"MAL-2026-11535","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require(), _adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames (assembled at runtime by joining string fragments such as [\"oob-worker.cf100-416.w\",\"orke\",\"rs.\",\"dev\"]), downloads an opaque binary over HTTPS with no version pin and no hash verification, writes it to /var/tmp/.cache_\u003crand\u003e or %TEMP%\\dotnet_diag_\u003crand\u003e.exe under a cover-story name, chmods it 0755, and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp + \" \u0026\"], {detached:true, stdio:\"ignore\"}).unref(). A DNS TXT-record fallback channel reassembles a base64 payload from numbered subdomains under *.dl.wel1.ru (hostname also constructed by split-and-join at runtime) when HTTPS is blocked. lib/telemetry.js in the same tarball contains the same dropper shape (cp.spawn to /bin/sh, chmodSync 0755, base64 reassembly from DNS chunks) behind an \"Analytics SDK\" cover story. The runtime hostname reconstruction, the DNS-TXT covert channel, the disguised staging paths, and the detached background execution grant arbitrary remote code execution on any host that installs or requires this package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bigops-backend (npm)","id":"MAL-2026-11535","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bigops-backend","purl":"pkg:npm/bigops-backend","source":"MAL-2026-11535"}],"products":null,"published":"2026-08-04","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-11535/"}