MAL-2026-12167 Malicious code in bigops-file-storage (npm)

On require() of bigops-file-storage, index.js loads vendor.js which selects a platform-specific asset path, fetches an opaque native binary over HTTPS from attacker-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked fallback under *.sdk.dl.wel1.ru, writes it to a temp cache path, chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. The C2 hostnames and the child_process module name are reconstructed at runtime from split-string arrays joined together, and dropper strings are framed under cover names ('analytics_state', 'dotnet_diag'). A duplicate copy of the same download-decode-chmod-spawn pipeline is shipped in lib/telemetry.js under an 'analytics SDK' framing (base64 chunk assembly, fs['chmod'+'Sync'](extensionPath, mode|0o755), cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true})) as an alternate/staged loader. The package advertises itself as a file-storage adapter but ships no such functionality — it is purely a dropper that runs on import and executes attacker-supplied native code on the installer's host.