MAL-2026-12652

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-configs/MAL-2026-12652.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12652
Published
2026-08-05T14:00:34Z
Modified
2026-08-05T14:36:08.569866878Z
Summary
Malicious code in cobrowsing-configs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558)

On require() of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT-record fallback channel under dl.wel1.ru (sdk.dl.wel1.ru, net.dl.wel1.ru). The destination hostnames are assembled at runtime by joining split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under deceptive names impersonating system artifacts (e.g., dotnetdiag_*.exe,.cache_*), chmod 0755 on Unix, and executed detached via spawn("/bin/sh", ["-c",...]) or spawn("cmd",...). No hash or signature verification is performed, and the fetched binary is unrelated to the package's stated purpose of loading configuration. The behavior fires as a side effect of importing the module, giving whoever controls the C2 hosts arbitrary code execution on any machine that installs and loads the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:00:34Z",
            "source": "amazon-inspector",
            "sha256": "45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558",
            "import_time": "2026-08-05T14:20:04.805521806Z",
            "id": "IN-MAL-2026-015127",
            "versions": [
                "35.7.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cobrowsing-configs

Package

Name
cobrowsing-configs
View open source insights on deps.dev
Purl
pkg:npm/cobrowsing-configs

Affected ranges

Affected versions

35.*
35.7.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "cobrowsing-configs-35.7.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-z9JXFU0t9unBuZQ6Mi4nnBjM/cI6ovTlAGf+FsNWaH+nmV03+94/Zs2kfb6H8TvYLH7fcLG1aWgpG7kcdc8V4w==",
                "sha1": "1e6314e66f9dc0f9f64cc98a2957ced9eeb1ac69"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "68a1965a166b70188bb097e4c7174416f65ae6633781c1c8fb9ca9985f73114c3b2efc",
            "sha256": "31e7bf9b543fe08ba5bab33da0661c7036a07c4f345d4d40d4c9a38676a89866",
            "path": "_polyfill.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-configs/MAL-2026-12652.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]