MAL-2026-12159

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-cobrowsing/MAL-2026-12159.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12159
Published
2026-08-05T08:47:24Z
Modified
2026-08-05T10:05:58.191950230Z
Summary
Malicious code in bigops-cobrowsing (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e81463953e6dde1f029deb6a15345c1f0e1a763e59c2f52e821c8e6f2d62f379)

On require of the package's main entry, compat.js selects a per-OS asset path and downloads a native binary from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT-record fallback resolving sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru to obtain a substitute host. The fetched bytes are written to a temp path under a disguised name (dotnetdiag<rand>.exe on Windows,.cache<rand> on Unix), chmod 0755, and executed detached via spawn("cmd",...) or spawn("/bin/sh", ["-c", fp+" &"]). Destination hostnames are reassembled at runtime via array.join("") string-split obfuscation (e.g. ["oob-worker.cf99-9b3.workers",".de","v"].join(""); ['sdk.dl.wel','1.r','u'].join("")). No publisher-matching source, no version pin, no hash/signature verification; declared purpose is a cobrowsing library, which does not require fetching and executing an opaque native binary from anonymous infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:47:24Z",
            "id": "IN-MAL-2026-014417",
            "import_time": "2026-08-05T09:28:08.856146701Z",
            "sha256": "e81463953e6dde1f029deb6a15345c1f0e1a763e59c2f52e821c8e6f2d62f379",
            "versions": [
                "35.4.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bigops-cobrowsing

Package

Name
bigops-cobrowsing
View open source insights on deps.dev
Purl
pkg:npm/bigops-cobrowsing

Affected ranges

Affected versions

35.*
35.4.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-cobrowsing-35.4.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-HDEk/3MyOu6JkBcWijfKxhv/4UoT4zAAIngsV6IlGvhIex1VCar2/hFMv9WCYwHxOwY6Jis/iG5IQ0YSQ+mbJA==",
                "sha1": "8bc92bb01dc2faf23e94c3fded3076e253f4f338"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "4ea1759a126a70194bb0abe48717441af65bf6633380c284fb5ca5d45f7326482b2efc",
            "sha256": "1777cd6e60db325088b0c189220890625b7b820a94f236ceeb9607a875064ca4",
            "path": "_compat.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-cobrowsing/MAL-2026-12159.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]