MAL-2026-12160

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-cobrowsing-client/MAL-2026-12160.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12160
Published
2026-08-05T08:46:21Z
Modified
2026-08-05T10:05:57.853330968Z
Summary
Malicious code in bigops-cobrowsing-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (25ce2f0f7a7411a7bfedb5d07449d26620388d3936e5951883e52463de01ef50)

On require() of this package, index.js loads shim.js which triggers an async payload that fetches a platform-specific binary from obfuscated Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp or %TEMP% under a masquerading name (.cache<rand> on Unix, dotnetdiag<rand>.exe on Windows), chmods it 0o755, and spawns it detached via /bin/sh or cmd.exe. Both the C2 hostnames and a DNS-TXT fallback channel (chunked base64 payload retrieved from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) are reconstructed at runtime via.join('') of split string fragments to evade static string detection. The DNS-TXT fallback reads a chunk count from c.<domain> and iterates <n>.<domain> TXT queries, base64-decoding the concatenation into an executable buffer that is written to disk and run. The package advertises itself as a cobrowsing client, but the shipped code contains no cobrowsing functionality — only the dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.1.9"
            ],
            "id": "IN-MAL-2026-014410",
            "import_time": "2026-08-05T09:28:07.941360464Z",
            "modified_time": "2026-08-05T08:46:21Z",
            "source": "amazon-inspector",
            "sha256": "25ce2f0f7a7411a7bfedb5d07449d26620388d3936e5951883e52463de01ef50"
        }
    ]
}
References
Credits

Affected packages

npm / bigops-cobrowsing-client

Package

Name
bigops-cobrowsing-client
View open source insights on deps.dev
Purl
pkg:npm/bigops-cobrowsing-client

Affected ranges

Affected versions

35.*
35.1.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-cobrowsing-client/MAL-2026-12160.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "bigops-cobrowsing-client-35.1.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-KZtmZF2DR2XOewJfqQ1PqaIZJ2VZiwsUmBc383nr5hGSids3XxgzmlwGn4o274rh87LamP0ZPdxHxkaoAYtXvQ==",
                "sha1": "fb49ed55269957e1961d75b9b415e46af76d21ce"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_shim.js",
            "tlsh": "6aa1749a1666701c8bb0ebf4c61b5415f65af66333808194f79c69885ff322483b2efc",
            "sha256": "7dc061b165a062dce0fcb775292272ed7f59f740623e8adf9009bca747f94afe"
        }
    ]
}