MAL-2026-12652
Dashboard / Malicious Package / MAL-2026-12652
MAL-2026-12652
Summary: Malicious code in cobrowsing-configs (npm)
Details: Source: amazon-inspector (45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558) On require() of cobrowsing-configs, index.js loads _polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT-record fallback channel under dl.wel1.ru (sdk.dl.wel1.ru, net.dl.wel1.ru). The destination hostnames are assembled at runtime by joining split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under deceptive names impersonating system artifacts (e.g., dotnet_diag_*.exe,.cache_*), chmod 0755 on Unix, and executed detached via spawn("/bin/sh", ["-c",...]) or spawn("cmd",...). No hash or signature verification is performed, and the fetched binary is unrelated to the package's stated purpose of loading configuration. The behavior fires as a side effect of importing the module, giving whoever controls the C2 hosts arbitrary code execution on any machine that installs and loads the package.
Affected packages
Package
Name: cobrowsing-configs
Purl: pkg:npm/cobrowsing-configs
Affected ranges
Type: N/A
Events:
