MAL-2026-12159
Dashboard / Malicious Package / MAL-2026-12159
MAL-2026-12159
Summary: Malicious code in bigops-cobrowsing (npm)
Details: Source: amazon-inspector (e81463953e6dde1f029deb6a15345c1f0e1a763e59c2f52e821c8e6f2d62f379) On require of the package's main entry, _compat.js selects a per-OS asset path and downloads a native binary from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT-record fallback resolving sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru to obtain a substitute host. The fetched bytes are written to a temp path under a disguised name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0755, and executed detached via spawn("cmd",...) or spawn("/bin/sh", ["-c", fp+" &"]). Destination hostnames are reassembled at runtime via array.join("") string-split obfuscation (e.g. ["oob-worker.cf99-9b3.workers",".de","v"].join(""); ['sdk.dl.wel','1.r','u'].join("")). No publisher-matching source, no version pin, no hash/signature verification; declared purpose is a cobrowsing library, which does not require fetching and executing an opaque native binary from anonymous infrastructure.
Affected packages
Package
Name: bigops-cobrowsing
Purl: pkg:npm/bigops-cobrowsing
Affected ranges
Type: N/A
Events:
