MAL-2026-12656
Dashboard / Malicious Package / MAL-2026-12656
MAL-2026-12656
Summary: Malicious code in cobrowsing-logger (npm)
Details: Source: amazon-inspector (8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea) index.js unconditionally requires _adapter.js on load. _adapter.js reconstructs destination hostnames from string-split fragments (assembling `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf102-baf.workers.dev`, `oob-worker.cf103-070.workers.dev`, `oob-worker.cf100-416.workers.dev`, and `sdk.dl.wel1.ru` / `ext.dl.wel1.ru` / `pkg.dl.wel1.ru` / `net.dl.wel1.ru` at runtime), platform-branches on the host OS, downloads an opaque executable over HTTPS with a DNS-TXT base64 fallback under the `*.dl.wel1.ru` zone, writes it to `/tmp` or `%TEMP%` under a decoy filename (`.cache_<hex>` on POSIX, `dotnet_diag_<hex>.exe` on Windows), chmods 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe`. An opt-out branch is gated on generic-telemetry environment variables to mimic benign analytics behavior. The dropped binary is not shipped in the tarball and is not verified by hash or signature; whatever the operator of the Workers hosts / DNS-TXT channel serves at fetch time runs detached on the installer's machine on every `require('cobrowsing-logger')`.
Affected packages
Package
Name: cobrowsing-logger
Purl: pkg:npm/cobrowsing-logger
Affected ranges
Type: N/A
Events:
